fix: Prevent agent HTTP auth redirect leaks

[lox]

Authenticated agent HTTP clients currently inject credentials in the transport layer, after Go's redirect sanitizer has already decided whether to strip Authorization. If a trusted Buildkite endpoint ever redirected to a different host or scheme, the redirected request could receive the agent token or bearer credential.

This keeps the normal redirect behavior for unauthenticated clients, but authenticated clients now stop at redirects that change scheme or host and return the redirect response instead. Same-origin redirects still follow normally and continue to include the expected authorization header.

For example, an authenticated request from https://agent.buildkite.com/... to a Location: https://example.invalid/... response will no longer follow that redirect with credentials attached, while /old to /new on the same origin continues to work.