Bind explicit credentials to the host they were configured for

With --source-follow-info-refs-redirect / --target-follow-info-refs-redirect, git-sync adopts the host /info/refs redirected to and addresses it directly for the follow-up RPCs — and re-attached the configured token to those requests, after Go's http.Client had deliberately stripped the Authorization header on the cross-host hop. Any redirect an attacker could cause collected the token: an open redirect on the real host, a hostile mirror, or a man-in-the-middle on a plain-http source. On the target side that token usually carries write access.

An explicitly supplied credential — token flags, bearer flags, or userinfo in the URL — is now sent only to the host named on the command line and its subdomains, on the same scheme and port. Anything else gets nothing, plus a warning naming the withheld host, and the credential helper is consulted for that host instead. Credentials resolved from the helper are untouched: those are looked up keyed on the host actually being challenged, so they were already bound to their destination.

The same-site rule is deliberately stricter than the stdlib's. Go compares hostnames only, ignoring scheme and port, so it will carry Authorization from host:443 to host:9999 — a different service, and on shared infrastructure potentially a different tenant. That gap is not visible from the request-building code either, because the redirect is followed inside a single http.Client.Do: by the time control returns the header is already on the wire. So redirect policy moves into a per-connection CheckRedirect that strips the header on any hop leaving the endpoint's site, layered over whatever policy the caller set. Setting CheckRedirect replaces the stdlib's ten-redirect default, so that cap is reimposed explicitly rather than lost.

The subdomain allowance keeps the case the flag exists for working: a hosting replica under the same domain, example.com to replica.example.com, still authenticates.

Tests cover the rule in isolation (including the near-misses: suffix without a dot boundary, attacker-controlled prefix domain, scheme downgrade, port change, IP addresses having no subdomains) and end to end against httptest servers, asserting the cross-site POST carries no credentials while a same-site redirect still does. Verified by hand too: the original two-server reproduction that leaked the token now logs an empty Authorization on both requests to the redirect target.

docs/usage.md gains a "Credentials and redirects" section — the flags were previously documented only in their flag help.