Credential disclosure via retained redirect header

Information exposure in Scrapy 2.10.1 allows remote attackers to read Authorization credentials through cross-domain redirects. RedirectMiddleware's _build_redirect_request constructs a follow-up request that retains the original Authorization header when the destination netloc differs. Reachability requires a credential-bearing request and a redirect to an attacker-controlled domain; the consequence is limited to disclosure of the retained header contents.