Ktor client resends auth data to redirect location

[dtretyakov]

Ktor Version and Engine Used
Ktor HTTP client 1.2.5 with Apache engine.

Describe the bug

Enable followRedirects for http client and send request with auth data to the host https://foo/redirect which redirects to the host https://bar with auth data from host foo.

To Reproduce
Steps to reproduce the behavior:

HttpClient(Apache) {
        followRedirects = true
    }.use { httpClient ->
    httpClient.get<HttpResponse>("https://foo/redirect") {
        basicAuthorization("login", "***")
    }
}

Actual result: Authorization header data is leaked to the host https://bar.

Expected behavior
The Authorization header from original request to the host foo is cleared before establishing redirect request to the host bar. It's a good security practice.

Comment
It could be solved by cleaning the Authorization header in the HttpRedirect feature:
https://github.com/ktorio/ktor/blob/master/ktor-client/ktor-client-core/common/src/io/ktor/client/features/HttpRedirect.kt#L39

[louro11]

CVE-2019-19703 was assigned to this issue