Use browser-like order of http headers to avoid triggering bot detections

[wofferl]

Summary

It seems that the fix #3533 now triggers bot detections like on reddit.com which now gets again "403 denied".

This PR makes sure that the headers are browser-like and, as before, with the User-Agent before other headers.
It also fixes the max redirect option which changed with guzzle 7.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Changelog entry added for all important changes.

[Copilot]

Pull request overview

Adjusts the backend HTTP client configuration (Guzzle) used by the News app’s fetchers to better mimic browser request header ordering (notably ensuring User-Agent precedes other headers) and to correctly apply the max-redirect limit after the Guzzle 7 option change—aiming to reduce 403/bot-detection blocks (e.g., Reddit).

Changes:

• Introduce a defaultConfig and merge it with the provided $config to control header insertion order and provide consistent defaults.
• Ensure User-Agent is present by default and merged ahead of other headers.
• Switch redirect limiting from the legacy redirect.max key to Guzzle 7’s allow_redirects['max'].