[release-branch.go1.23] net/http: strip sensitive proxy headers from redirect requests

[release-branch.go1.23] net/http: strip sensitive proxy headers from redirect requests

Similarly to Authentication entries, Proxy-Authentication entries should be stripped to ensure sensitive information is not leaked on redirects outside of the original domain.

https://fetch.spec.whatwg.org/#authentication-entries

Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this issue.

Updates golang/go#73816
Fixes golang/go#73905
Fixes CVE-2025-4673

Change-Id: I1615f31977a2fd014fbc12aae43f82692315a6d0
Reviewed-on: https://go-review.googlesource.com/c/go/+/679255
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Michael Knyszek <mknyszek@google.com>