fix(security): remove proxy and cookie auth headers on insecure redirect

[MIchaelMainer]

Current behavior is that RedirectHandler only removes Authorization header on redirects that change host and scheme.

This PR addresses the scenario where proxy authorization, cookie authorization, or API Key headers are present on redirect.

Security Changes to RedirectHandler

1. Sensitive Header Scrubbing on Redirects

File: src/http/httpClient/Middleware/Options/RedirectHandlerOption.cs

• Added ScrubSensitiveHeaders callback property - allows customization of which headers to remove during redirects. Useful for API Keys and other custom authorization headers.
• Added DefaultScrubSensitiveHeaders static method implementing secure default behavior:
  • Removes Authorization and Cookie headers when redirecting to a different host or scheme
  • Removes Proxy-Authorization header when no proxy is active for the destination

2. Proxy-Aware Header Handling

File: src/http/httpClient/Middleware/RedirectHandler.cs

• Added GetProxyResolver() method - returns a function that checks if a proxy applies to a destination URI
• Added GetProxyFromFinalHandler() method - traverses the handler chain to extract IWebProxy from HttpClientHandler, SocketsHttpHandler, or WinHttpHandler
• Integrated scrubbing callback into redirect flow

Why These Changes Matter

Header	Risk Without Scrubbing
Authorization	Credentials leaked to untrusted redirect target
Cookie	Session tokens leaked cross-domain
Proxy-Authorization	Proxy credentials sent directly to origin when proxy no longer applies

Ref: microsoft/kiota-java#2081

[baywet]

Left a question regarding the proxy authorization

[github-actions]

This pull request has conflicting changes, the author must resolve the conflicts before this pull request can be merged.