fix(xmr): S06c - reject signer HTTP redirects

Prevent signer requests from following redirects away from the configured endpoint. Also reject redirect responses with missing or empty Location headers, which could previously be accepted as successful JSON responses.

Series context

S06c follows up on S06 (!5052). It belongs to the focused XMR hardening series tracked here.

• Scope: XMR signer HTTP redirect handling in Bifrost.
• Base and target: develop.
• Dependencies: S06 (!5052 (merged)) is already included in develop.
• Consensus impact: none.

Rationale

S06 (!5052 (merged)) validates the configured signer URL, but automatic redirects can bypass that validation by moving requests to another destination, including an HTTPS-to-HTTP downgrade. Redirects can also resend signing or recovery POST bodies to that destination through 307/308 handling.

Rejecting redirects keeps requests bound to the explicitly configured signer. The signer exposes fixed API routes, so requiring direct responses gives a simple transport contract without additional per-hop destination and credential policies.

Redirect rejection must also cover responses without a usable Location header: these can be returned directly by the HTTP client, allowing valid-looking JSON to reach the success decoder. Rejecting such responses before decoding closes that remaining path.

Changes

• Reject redirects for both general signer requests and signing requests.
• Reject HTTP responses with status 300 or higher before decoding success data.
• Keep rejected redirect URLs out of error messages.
• Add regression coverage to the existing client_security_test.go.

Verification

• Tests cover GET, restore, and signing requests, including missing and empty Location headers.
• Tests confirm redirect targets receive no requests and direct successful requests still work.
• The original failures were reproduced against the public base.

Rollout

Signer endpoints must serve requests directly. Configurations that depend on redirects will now fail.