Drop sensitive headers when following redirects

[lpinca]

Do not forward the Authorization and Cookie headers if the redirect
host is different from the original host.

[lpinca]

This is the topic of some recent CVEs like https://nvd.nist.gov/vuln/detail/CVE-2022-0235, and https://nvd.nist.gov/vuln/detail/CVE-2022-0155, but I will not create a security advisory for ws because

1. Redirects are not followed by default.
2. The issue was known when the feature was added (Add ability to follow redirects #1490).
3. I do not think this fixes the issue because there might be other headers containing sensitive data, like X-AUTH-KEY, X-API-KEY, etc. It might actually break legitimate use cases.
   • Refs: https://bugs.python.org/issue33661
   • Refs: fix(Headers): don't forward secure headers to 3th party node-fetch/node-fetch#1449 (comment)
   • Refs: fix(Headers): don't forward secure headers to 3th party node-fetch/node-fetch#1449 (comment)