fix(http_proxy): preserve upstream redirects for SSO flows

[dengxiayehu]

Problem

The HTTP proxy client followed upstream redirects automatically. As a result, callers could not receive
the original 3xx response and Location header required to complete SSO handoff flows.

Regular HTTP redirects were followed by the proxy itself, while redirects using a custom URI scheme
could fail before reaching the client.

Fix

• Add a keepalive HTTP client variant that disables automatic redirect handling while preserving the
  existing timeout, connection pool, and TCP keepalive behavior.
• Use the no-redirect client in the HTTP proxy, including its fallback construction path.
• Return upstream redirect responses and Location headers unchanged so the calling client can handle
  the SSO redirect.
• Add regression coverage for both regular HTTP redirects and custom URI scheme redirects, including
  verification that the proxy does not request the redirect destination.