Re-resolve system proxy routes across redirects (#34479)

## Why

Route-aware clients select a direct or proxy route from the complete request
URL. Letting `reqwest` follow redirects internally reuses the client chosen for
the original URL, so the redirect destination cannot receive its own PAC or
system proxy decision.

## What changed

- Follow redirects through `RouteAwareClientPool` when respecting the system
  proxy, resolving and caching a route for every hop.
- Preserve standard redirect method and body behavior, enforce one timeout
  across the request chain, and cap redirects at 10 hops.
- Strip origin-sensitive credentials and stale proxy authorization when the
  destination or selected route changes, and apply safe `Referer` handling.
- Log one final request outcome instead of intermediate redirect responses.

## Testing

Added an integration test covering a redirect from a direct route to a proxy
route, credential handling, and final-outcome logging.

GitOrigin-RevId: e5cb2cc962e99d33df61ef649465e956b92279bb

codex-rs/http-client/src/route_aware_client_pool_tests.rs

@@ -249,8 +249,10 @@ async fn resolve_with(
     request_url: &str,
 ) -> Result<HttpClient, RouteAwareClientPoolError> {
     let resolver = resolver.clone();
-    pool.client_for_url_with_resolver(request_url, move |request_url| async move {
-        resolver.resolve(request_url).await
-    })
-    .await
+    let (_, client) = pool
+        .client_for_url_with_resolver(request_url, move |request_url| async move {
+            resolver.resolve(request_url).await
+        })
+        .await?;
+    Ok(client)
 }