WithAuthToken authorizes requests outside configured hosts

## Summary

`WithAuthToken` installs a transport wrapper that adds `Authorization: Bearer ` to outgoing requests. When callers build a request with an absolute URL outside the client's configured API or upload origins, that wrapper still adds the bearer token before sending the request.

## Expected behavior

The token configured through `WithAuthToken` should only be attached to requests targeting the client's configured API or upload origins. Requests to other origins should be sent without this transport-managed authorization header.

## Reproduction

This can be reproduced with `httptest` servers by configuring a client with trusted API/upload URLs, then issuing requests using absolute URLs for another server and checking whether that server receives an `Authorization` header.

## Proposed fix

PR #4363 limits token injection to the configured API and upload origins, and includes regression coverage for trusted API/upload requests and cross-host absolute URL requests.

从 WithAuthToken transport wrapper 及其用于绝对 URL 的 request path 开始。使用针对可信 API/upload origin 和另一个独立 origin 配置的 httptest 服务器复现该行为，然后验证可信 request 会保留 authorization，而跨 host 的 request 不会保留 authorization。PR #4363 及其回归覆盖描述了已经提出的工作。

由索引模型根据 Issue 内容生成。