[Security] Authorization Header Leak on Cross-Origin 307/308 Redirects

## Summary

superagent leaks Authorization headers to attacker-controlled servers when following cross-origin 307/308 redirects. The existing credential-stripping logic only applies to 301/302/303 redirects.

## Details

In lib/node/index.js, the _redirect() method calls cleanHeader() for 301/302/303 (strips auth on cross-origin) but for 307/308 only deletes host header. Auth headers leak.

## PoC

1. Legitimate server returns 307 to evil.com
2. Client sends request with Authorization header
3. evil.com receives the full Authorization header

## Impact

- Credential theft via 307/308 redirects
- ~5M weekly npm downloads
- CVSS 6.5, CWE-522

## Fix

Call cleanHeader() in the 307/308 path when origin changes.

References: CVE-2023-45143 (undici), CVE-2023-46136 (got)