Suppress outbound HTTP redirects in the sidecar by default

[soodt]

#Suppress outbound HTTP redirects in the sidecar by default

• You've read the Contributor Guide and Code of Conduct.
• You've included unit or integration tests for your change, where applicable.
• You've included inline docs for your change, where applicable.
• There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.

Summary of the changes (Less than 80 chars)

Description

Suppress outbound HTTP redirects in the sidecar by default, with an opt-in  Sidecar:AllowOutboundRedirects  flag to restore following them.

Changes

• Add Sidecar:AllowOutboundRedirects (bool, default false).
• ConfigureHttpClientDefaults sets SocketsHttpHandler.AllowAutoRedirect from the option; scoped
  to the sidecar host — the shared Microsoft.Identity.Web.DownstreamApi library is unchanged.
• Set AllowOutboundRedirects=true to restore following redirects.

Tests

• Redirect not followed by default (302 returned to caller; redirect target not contacted).
• Opt-in restores following.
• Guard asserting the sidecar uses the default IHttpClientFactory path (bearer only).

Docs

• README documents the new option.

{Detail}

Fixes #{bug number} (in this specific format)