fix: stop forwarding credentials to cross-origin redirect targets

[ethicnology]

HttpService.sourceRequestStreamResponse follows redirects manually. On
every hop it re-applies the original request headers — including
Authorization (e.g. the GitHub PAT sent as Token …) and any custom
headers configured for HTML sources — regardless of the redirect target's
origin. Session cookies collected along the way are forwarded the same way.

A source answering 302 to a third-party host therefore receives the
user's credentials. The same loop also follows https → http downgrades,
silently dropping to cleartext.

What this PR changes

In the redirect loop only:

• On a cross-origin redirect (scheme, host or port differs), Authorization,
  Proxy-Authorization and Cookie headers are stripped, and accumulated
  session cookies are not forwarded.
• https → http redirects are refused with an error instead of being
  followed.
• Same-origin redirects are unchanged: headers and cookies are kept, so
  legitimate flows (e.g. same-host API redirects) keep working.

What it deliberately does NOT change

• The APK download path (downloadFile), which delegates redirect
  following to dart:io and does not re-apply custom headers — verified
  safe.
• No behavior change for same-origin redirects, no new settings, no UI
  besides one new error string (en.json only, other locales to follow via
  the usual translation process).

Tests

Regression tests are ready (cross-origin strip, same-origin keep, downgrade
refusal, plus a control for the download path) and will follow in a
dedicated test PR once this lands — the project has no flutter_test
harness yet, and adding it here would mix infrastructure with the fix.