[php-src] Issue #24315: Harden SoapClient cross-origin redirect handling

Issue: https://github.com/php/php-src/issues/24315 Author: alexandre-daubois ### Description Originally reported by @iliaal SoapClient resends its configured Basic credentials and SOAP request body when following a redirect to a different origin. Start these two local endpoints: ```php <?php // router.php if ($_SERVER['SERVER_PORT'] === '8001') { header('Location: http://127.0.0.1:8002/', true, 302); exit; } file_put_contents('php://stdout', ($_SERVER['HTTP_AUTHORIZATION'] ?? 'none') . "\n"); ``` ```bash php -S 127.0.0.1:8001 router.php php -S 127.0.0.1:8002 router.php ``` Run: ``` <?php $client = new SoapClient(null, [ 'location' => 'http://127.0.0.1:8001/', 'uri' => 'urn:test', 'login' => 'user', 'password' => 'secret', ]); try { $client->__soapCall('ping', []); } catch (SoapFault $e) { } ``` Actual: port 8002 receives Authorization: Basic dXNlcjpzZWNyZXQ=. Expected: credentials remain scoped to their original origin. We should consider rejecting cross-origin redirects as hardening, since stripping authentication headers alone still forwards the SOAP body. ### PHP Version ```plain All ``` ### Operating System _No response_