FIX harden HTTP target request and upload handling

[Roman Lutz (romanlutz)]

Description

Finding by Roman Lutz (@romanlutz) and Microsoft Security FORGE Lab.

HTTP target prompt substitution could alter the configured destination, inject new request headers, follow redirects without explicit operator control, or cause HTTPXAPITarget to upload locally accessible files without containment. This change adds safeguards while preserving existing behavior for current callers.

• Pin raw HTTP requests to the operator-configured scheme, host, and port after prompt substitution.
• Add explicit follow_redirects control to HTTPTarget and HTTPXAPITarget, defaulting to the existing enabled behavior for compatibility.
• Reject CR/LF prompt values when substituted into the request line or headers, while preserving multiline body prompts.
• Add canonical upload containment through allowed_upload_directory.
• Preserve uploads without an allowed directory and legacy implicit text-path uploads through 1.3.0 with deprecation warnings; path-typed message pieces use the hardened path flow immediately.
• Validate canonical containment and file existence before validating whether the HTTP method supports uploads.

Tests and Documentation

Added focused unit coverage for destination changes, arbitrary operator-configured internal destinations, enabled and disabled redirects, CR/LF injection contexts, multiline request bodies, upload-directory containment, validation ordering, and deprecated compatibility paths. The combined HTTP-target suite passes with 48 tests.

Documentation was not changed because the affected constructor parameters and behavior are documented in their API docstrings. JupyText was not run because no documentation notebooks were modified.