net/http: sensitive headers incorrectly sent after cross-domain redirect [CVE-2024-45336] [1.24 backport]

[gopherbot]

@neild requested issue #70530 to be considered for backport to the next 1.24 minor release.

@gopherbot please open backport issues for 1.22, 1.23, and 1.24

[gopherbot]

Change https://go.dev/cl/643100 mentions this issue: net/http: persist header stripping across repeated redirects