Auth transports add credentials after cross-origin redirects

[huynhtrungcsc]

Summary

BasicAuthTransport and UnauthenticatedRateLimitedTransport add credentials in RoundTrip for each outgoing request. When Go's net/http client follows a redirect to a different origin, the redirected request can pass through the same transport and receive those credentials again.

Expected behavior

Credentials added by these transports should only be sent to the original origin. Redirected requests that cross origin should continue without these transport-managed credentials.

Reproduction

This can be reproduced with two httptest servers: one server returns a redirect to a second server, and the second server records whether the redirected request contains the transport-added authorization headers.

Proposed fix

PR #4364 avoids adding these credentials on cross-origin redirect requests and includes regression coverage for both affected transports.

[stevehipwell]

@huynhtrungcsc given that the transport is an implementation detail of go-github do you have an example of a case where a valid GitHub redirect redirects to an untrusted source? From my understanding all cross origin redirects from the GitHub API are "trusted".