gitproto: track resolved endpoint separately from user input

Addresses review feedback: the auth path was mutating c.EndpointURL when adopting a cross-host challenger, conflating "the URL the user typed" with "where we ended up after redirects." The mutation also fired without checking FollowInfoRefsRedirect, so the auth flow was effectively following redirects even when the user had opted out of that.

Two changes in one:

1. No more EndpointURL mutation. A new c.resolvedEndpoint field carries the post-redirect scheme/host when one's been discovered; c.EndpointURL stays exactly as the caller passed it in. URL-building reads c.requestURL(), which returns resolvedEndpoint when set and EndpointURL otherwise. The user-typed URL is now stable for display, logging, telemetry, the SSH-scheme check in refs.go, and the github.com check in bootstrap.go — none of which want the resolved value.

   The existing FollowInfoRefsRedirect block in RequestInfoRefs also stops mutating EndpointURL and writes to resolvedEndpoint instead, for consistency.

2. adoptChallengeHost is now gated on FollowInfoRefsRedirect. The user's explicit opt-in is the trigger for the conn's effective endpoint changing. With the flag off the immediate retry still hits the challenger directly (so the current op succeeds and the helper Approves valid creds on the right key — the production bug stays fixed), but follow-up ops on the same conn stay pointed at the user-typed URL. They'll surface a 401 the user can address by setting the flag.

The two TLS-off cross-host gates compare against c.requestURL().Host rather than c.EndpointURL.Host, so they remain correct on a conn that has already adopted a previous redirect (otherwise a same-host 401 from the resolved endpoint would look "cross-host" to the gate).

Tests:

• TestRequestInfoRefs_FollowInfoRefsRedirect and the cross-host auth / EnsureAuthForService tests now assert (a) EndpointURL is unchanged and (b) resolvedEndpoint carries the discovered host.
• The two adoption tests set FollowInfoRefsRedirect=true to opt in; a new TestRequestInfoRefs_CrossHostRetryWithoutFollowFlagSucceeds- ButDoesNotAdopt covers the gated half — flag off, retry still works, resolvedEndpoint stays nil.
• TestRequestInfoRefs_DoesNotFollowByDefault and both TLS-off tests now also assert resolvedEndpoint == nil.