Strip custom auth headers on cross-origin redirects

Editor assessment

This commit patches CVE-2026-32913. The header `fix(security): strip custom auth headers on cross-origin redirects` describes the exact behavior change and the condition that triggers it, so the subject is self-sufficient. The `security` scope matches the repository's pattern and the type is correct. There is no body, meaning the message does not name the header prefix, the redirect scenario, or whether same-origin redirects still forward the headers. That is the only real gap, and the clean imperative wording, sensible length, and absence of footer noise compensate. It is a strong, publishable example.