CVE-2024-28849 — Follow-Redirects credential forwarding

follow-redirects forwarded the Authorization header to cross-origin redirects, leaking credentials to attacker-controlled hosts during ordinary HTTP client use (including via Axios).