Session cookie disclosure via cross-host redirect

Information disclosure in Orange Open Source Hurl 8.0.1 and earlier allows attackers to read session cookies via an attacker-controlled redirect. In packages/hurl/src/http/client.rs, the redirect path clears Authorization, Cookie, and basic-auth state when the host changes but fails to clear RequestSpec.cookies populated from the dedicated [Cookies] section before sending the redirected request. Exposure requires a .hurl file that uses the [Cookies] section and follows a redirect to a different host; raw Cookie headers are stripped, so the consequence is limited to cookie disclosure and any downstream session reuse those cookies permit.