fix: preserve csrf context for same-server file fetches

[rasitakyol]

What?

• Preserve Payload authentication and CSRF metadata only for trusted same-server file fetches.
• Recognize both relative URLs and absolute URLs that match the configured server origin.
• Strip Payload cookies and CSRF metadata when a fetch redirects cross-origin.

Why?

Cloud storage focal-point updates can re-fetch an image through a protected Payload route. The internal request kept too little CSRF context, so cookie authentication failed and req.user was null. Absolute URLs generated from serverURL were also treated as external.

How?

• Derive header trust from the configured or allowlisted request origin; the browser Origin header is forwarded only as CSRF metadata after the target matches that trusted origin.
• Rebuild default headers for every redirect hop, retaining non-Payload cookies while removing Payload cookies, Origin, and Sec-Fetch-Site from cross-origin requests.
• Keep the externalFileHeaderFilter contract unchanged. This also addresses the origin-trust concern raised in fix(uploads): prevent SSRF and auth-cookie leak in getExternalFile #17290 without blanket-stripping authentication required by protected same-server storage routes.
• Validated with Node 24.15.0 and pnpm 11.9.0: pnpm test:int:sqlite test/uploads/int.spec.ts (110 passed), pnpm build:payload --force, Prettier, source ESLint, and git diff --check.

Fixes #17293