Adds shouldStripHeaderOnRedirectIfOnDifferentHostOnly option on Request

[meghfossa]

Overview

This PR,

• adds shouldStripHeaderOnRedirectIfOnDifferentHostOnly option to Request
• modifies getRedirectedRequest signature to include original Request

Why?

Many stdlib in other language and ecosystem offer this functionality by default - refer to golang and python-requests for example. Potentially leaking headers to different host can lead to security incident. Refer to Python's CVE re this: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20060

Ideally, shouldStripHeaderOnRedirect should have only stripped headers if the host differed, so without breaking change, this seems to be second best option.

Previous discussion on this topic: #300

Testing

• I added few automated tests.

Remaining

• Anything else is needed for contribution or release?

[meghfossa]

Hi @snoyberg, let me know what I can do to get this to finish line!

[snoyberg]

Seems reasonable. Can you add a minor version bump and changelog entry? Also, please bump the @since comment to match the new version.

[snoyberg]

Thanks! Released to Hackage.