MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches

Summary makessrfsafehook blocks HTTP redirects to private/internal IPs by validating the Location header before the client follows a 3xx response. The problem is that this hook is only attached in one of three authentication branches — the header-PAT path. Basic auth and OAuth branches skip it...