Auth transports add credentials after cross-origin redirects

## Summary

`BasicAuthTransport` and `UnauthenticatedRateLimitedTransport` add credentials in `RoundTrip` for each outgoing request. When Go's `net/http` client follows a redirect to a different origin, the redirected request can pass through the same transport and receive those credentials again.

## Expected behavior

Credentials added by these transports should only be sent to the original origin. Redirected requests that cross origin should continue without these transport-managed credentials.

## Reproduction

This can be reproduced with two `httptest` servers: one server returns a redirect to a second server, and the second server records whether the redirected request contains the transport-added authorization headers.

## Proposed fix

PR #4364 avoids adding these credentials on cross-origin redirect requests and includes regression coverage for both affected transports.

Start with BasicAuthTransport and UnauthenticatedRateLimitedTransport, especially their RoundTrip methods, and reproduce the behavior with two httptest servers as described. Done means regression coverage exists for both transports and redirected requests to a different origin do not contain their transport-added authorization headers.

Written by the indexing model from the issue text.