#1137 fix(shared): strip credentials and request bodies when safeFetch follows redirects

Problem

safeFetch re-sends the original headers and body to every redirect target. A webhook configured with Authorization or a secret header (WebhookProvider) leaks them to whatever host the endpoint redirects to, and a 301/302/303 redirect of a POST is replayed as a POST with the body.

Fix

New exported redirectInit applied on each hop:

• cross-origin: keep only accept, accept-language, content-type, user-agent
• 301/302 on POST and 303 on non-GET/HEAD: switch to GET and drop the body and content-* headers (as in the Fetch spec)
• 307/308 and same-origin hops are otherwise unchanged

Tests

Added redirectInit cases to ssrf-guard.test.ts.

---

Summary by cubic

Fixes safeFetch so redirects no longer forward credentials or request bodies to the redirect target.

• Cross-origin hops keep only accept, accept-language, content-type, and user-agent headers, dropping Authorization and secret headers.
• 301/302/303 redirects of a POST switch to GET and drop the body and content-* headers, matching the Fetch spec.
• Same-origin and 307/308 redirects keep behavior unchanged.
• Added tests for the new redirectInit export.