gitproto: align HTTP redirect-following with git's default (only /info/refs, not POSTs)

[Soph]

Follow-up from PR #65 review feedback by @nodo:

FollowInfoRefsRedirect follows all redirects. Upstream by default only follows the initial request, follow-on redirect won't get the creds unless users actively opt-in.

Background

Vanilla git's HTTP transport defaults to http.followRedirects=initial: it follows the /info/refs redirect to discover the actual host, but POSTs (/git-upload-pack, /git-receive-pack) do not follow redirects. Users opt in to "follow everything" with http.followRedirects=true.

Our http.Client uses Go's stdlib default — follow all redirects up to 10. So a POST that 3xx's gets transparently followed where git push / git fetch against the same URL would surface the 3xx to the caller.

Why it matters

1. Behavioral divergence from vanilla git on the same URL. Users hitting a redirecting endpoint may get different results from git-sync vs. git.
2. Authorization stripping on cross-host POST redirects. Go's shouldCopyHeaderOnRedirect strips the header on cross-host hops. PR auth: defer credential helper until 401, match git's behaviour #65 fixed the credential-helper retry path against this (commit 5ec540df), but explicit auth (--target-token, Entire DB token) on a POST that gets redirected mid-flight is still subject to the strip without us noticing — it just looks like a 401 from "the wrong host."
3. More permissive than git. A server returning 307 on a POST gets silently retried at the new location by us; vanilla git would surface it.

Proposed shape

Install a custom CheckRedirect on the conn's http.Client:

• GET (e.g. /info/refs): follow as today.
• POST (/git-receive-pack, /git-upload-pack): refuse to follow by default; surface the 3xx via http.ErrUseLastResponse. Allow follow when FollowInfoRefsRedirect=true (or a new dedicated flag if we want distinct controls — argument for: FollowInfoRefsRedirect is currently semi-misnamed because it already affects POSTs indirectly via endpoint adoption).

Scope

• Touches NewHTTPConn / NewHTTPConnWithClient to install the CheckRedirect.
• Possibly adds a new flag or renames FollowInfoRefsRedirect.
• Affects every POST on a redirecting endpoint, not just the auth flows PR auth: defer credential helper until 401, match git's behaviour #65 addressed.

Related

PR #65 commits for context:

• 5ec540df — cross-host helper-auth retry hits the challenger directly.
• 89369084 — refuse cross-host helper retry with InsecureSkipTLSVerify.
• c01a2da7 — track resolved endpoint separately from user input (resolvedEndpoint field).
• 27e145fd — challengeURLFor doc on the orig-path keying choice.