follow-redirects sensitiveHeaders regex escaping can expose credential headers

Summary follow-redirects 1.16.0 introduced the sensitiveHeaders option the fix for CVE-2026-40895 / GHSA-r4q5-vmmm-2653, which lets an application declare extra header names that must be removed when a redirect crosses to a different host or downgrades protocol. The filter is a single...