Fork creation from canonical Tangled repository URLs currently fails because the repository endpoint redirects Git HTTP requests to its Knot host, while Knot2's HTTP transport does not follow redirects.
This change adds bounded, SSRF-guarded redirect handling for Git fetches, preserves the effective redirected upstream for subsequent requests, and keeps the original canonical URL as the fork origin. Cross-origin credentials are stripped, HTTPS downgrades are rejected, and redirect loops are bounded.
Tests cover canonical cross-host redirects, POST preservation, unsafe redirect rejection, and fork synchronization.