Add defaultCheckRedirect to both GitHub and Gitea clients that rejects:
- HTTPS→HTTP protocol downgrades (prevents plaintext leakage)
- Cross-host redirects entirely (prevents consuming untrusted responses)

Same-host, same-or-upgraded-scheme redirects remain allowed.

Both NewClient constructors wire the policy, and SetHTTPClient(nil)
restores it. Callers providing a non-nil client are responsible for
configuring their own safe redirect policy.

Closes #95

@@ -81,0 +85,4 @@
+func defaultCheckRedirect(req *http.Request, via []*http.Request) error {
+	if len(via) >= 10 {
+		return fmt.Errorf("stopped after 10 redirects")
+	}

@@ -81,0 +90,4 @@
+	// zero-length to avoid panic on index out of range.
+	if len(via) == 0 {
+		return nil
+	}

@@ -78,18 +78,61 @@ type Client struct {
 	MaxDiffSize int64

@@ -81,0 +95,4 @@
+	// Reject protocol downgrade: HTTPS→HTTP leaks request metadata over plaintext.
+	if prev.URL.Scheme == "https" && req.URL.Scheme == "http" {
+		return fmt.Errorf("refusing redirect: HTTPS to HTTP downgrade (%s → %s)", prev.URL.Host, req.URL.Host)
+	}

@@ -107,6 +107,32 @@ type Client struct {
 	now func() time.Time

@@ -110,0 +120,4 @@
+	if len(via) == 0 {
+		return nil
+	}
+	prev := via[len(via)-1]

@@ -81,0 +90,4 @@
+	// zero-length to avoid panic on index out of range.
+	if len(via) == 0 {
+		return nil
+	}

@@ -110,0 +119,4 @@
+	// zero-length to avoid panic on index out of range.
+	if len(via) == 0 {
+		return nil
+	}

@@ -80,1 +80,4 @@
 
+// defaultCheckRedirect is the redirect policy used by NewClient.
+// NOTE: This function is intentionally duplicated in github/client.go (and vice versa)
+// because the packages are separate. Changes here must be mirrored there.

@@ -81,0 +93,4 @@
+	if len(via) == 0 {
+		return nil
+	}
+	prev := via[len(via)-1]

@@ -78,18 +78,63 @@ type Client struct {
 	MaxDiffSize int64

@@ -107,6 +107,34 @@ type Client struct {
 	now func() time.Time