fix(fetchkit): re-sign bot-auth headers on redirect hops

[chaliy]

Motivation

• Prevent replay/leakage of bot-auth Signature/Signature-Input headers that were generated once for the initial authority and forwarded unchanged to subsequent redirect hops, which can expose replayable credentials to cross-host redirects.

Description

• Stop precomputing and attaching bot-auth headers before manual redirect handling in fetch() and fetch_to_file() by removing the one-time apply_bot_auth_if_enabled(...) calls there.
• Recompute and apply bot-auth headers per hop inside send_request_following_redirects() by calling apply_bot_auth_if_enabled(headers.clone(), options, &current_url) before building the reqwest client for each request.
• Preserve non-bot-auth behavior and keep changes feature-gated so behavior is unchanged when the bot-auth feature is disabled.

Testing

• Ran cargo test -p fetchkit --features bot-auth and all crate tests passed, including bot_auth unit tests and fetchers::default tests that assert headers are sent (10 tests ran and passed).
• Ran cargo fmt --all with no formatting issues.

---

Codex Task