Add ability to follow redirects

[lpinca]

Known defects:

• The options object it rebuilt after every redirect. This could be optimized to only do it once and update only the options that need to be changed after every redirect.
• There might be issues if an agent is used and the protocol is changed from HTTPS to HTTP or vice versa since HTTPS and HTTP use different agents.

Fixes #812

[piranna]

• There might be issues if an agent is used and the protocol is changed from HTTPS to HTTP or vice versa since HTTPS and HTTP use different agents.

I would throw an error if changuing from HTTPS to HTTP to notify about security issues by default, and maybe add an option to disable it.

[lpinca]

We can but afaik none of the most popular HTTP libs (request, got, node-fetch, axios, etc.) do it. Accepting redirects has a lot of security implications, like open redirect attacks, or passing authorization headers when the hostname changes.

It should be enabled only when the server is trusted.

[piranna]

It should be enabled only when the server is trusted.

So do you think just lefting redirections as an opt-in is just enough?

[lpinca]

I don't know if it is enough, but it is the reason why I chose to not follow redirects by default.

[piranna]

Great! Thank you :-)

[ad-m]

I think the redirect address should be emitted in some way to allow tracking.