fix: sanitize credentials on cross-origin redirects

[tomatotomata]

Summary

• remove Cookie and Authorization before following a runtime redirect to a different origin
• keep same-origin redirects and skipHeaderSanitize behavior unchanged
• add a local regression test covering a cross-port redirect with credentials

Validation

• npx mocha -t 10000 -R spec test/leak.test.js --grep 'runtime redirect' passed
• git diff --check passed

I traced the existing sanitizer and found it only inspected URLs embedded in the initial query string. The redirect target normally arrives later in the HTTP Location header, so I wrapped the redirect callback and compare the current URI with the resolved target before the request library follows it. This keeps the change at the credential boundary described in #155. Let me know what you think.