[php-src] PR #24329: Fix GH-24315: Harden SoapClient cross-origin redirect handling

Pull Request: https://github.com/php/php-src/pull/24329 Author: iliaal SoapClient followed any Location header and resent the HTTP authentication credentials, the stream context headers, and the SOAP envelope to whatever origin it named. Redirects to a different scheme, host, or port now fail with a SoapFault, except a same-host upgrade from http to https on port 443. The new follow_cross_origin_redirects SoapClient option restores the previous behavior for deployments that depend on it. The issue notes that stripping credentials would still forward the envelope, so this rejects the redirect instead. That is stricter than the http stream wrapper used for WSDL fetches, which strips Authorization and Cookie on a cross-origin redirect (5af9465ca89) and also counts http to https as cross-origin. Master only, since it changes behavior; UPGRADING carries the note. Fixes #24315