Don't forward credentials when the verification fetch encounters a cross-origin redirect

[jeremy]

Summary

The native redirect-verification fetch in HttpRepository attaches the WebView's cookies to the request as a static Cookie header and then issues it with a client that follows redirects. When the requested URL responds with a cross-origin redirect, OkHttp forwards that manually-set Cookie header to the redirect destination — delivering first-party session cookies to a different origin. (OkHttp drops the Authorization header when a redirect changes host, but it does not drop a caller-set Cookie header.)

This fetch only needs to detect whether the response is a cross-origin redirect; it never needs to follow that redirect with credentials. This change stops following redirects on the verification fetch and inspects the Location header directly, so no credential-bearing request is ever sent to a redirect destination.

Changes

• Don't follow redirects on the verification fetch. Its client is now derived from the shared client (keeping its cache, timeouts, and interceptors) with followRedirects(false) / followSslRedirects(false).
• Resolve the destination from Location. The redirect target is computed by resolving the Location header against the request URL, so relative, protocol-relative, and absolute locations are all handled correctly.
• Compare full origin, not just host. A redirect is treated as cross-origin when scheme, host, or port differ — so an HTTPS→HTTP downgrade or a port change is correctly detected as cross-origin.
• Caller. Session.visitRequestFailedWithNonHttpStatusCode previously gated on response.isSuccessful, which only held when redirects were followed through to a 2xx. Since the verification fetch no longer follows redirects, the response is the unfollowed 3xx; detecting a cross-origin redirect is now sufficient to propose the cross-origin redirect visit.

Only the first redirect hop is inspected — sufficient to detect a direct cross-origin redirect. Deeper same-origin chains that would eventually cross origin now fail closed (the visit fails) rather than being followed with credentials.

Testing

Adds HttpRepositoryTest (MockWebServer):

• A cross-origin redirect is detected and its destination receives no request at all — so no Cookie or other credential can reach it — while the first-party request still carries its cookies.
• A same-origin redirect is detected and correctly not flagged cross-origin.
• A relative Location resolves against the request origin (same-origin).
• A direct 2xx response reports no redirect.

Scope run locally: ./gradlew :core:testDebugUnitTest (core module unit tests).