Credential exposure via same-host transport downgrade

Credential exposure in rclone before 1.75.0 allows man-in-the-middle attackers to capture WebDAV credentials after unsafe redirects. PreserveMethodRedirectFn restores the original WebDAV method but neither rejects HTTPS-to-HTTP downgrades nor compares the full origin tuple, so Go forwards Basic authorization and Cookie headers to plaintext HTTP on the same host. Exploitation requires a legitimate endpoint, gateway, or accelerator to issue the downgrade redirect and an on-path observer; reused credentials permit only the compromised account's authorized WebDAV operations.