HDR1: Origin + Sec-Fetch-* Header Forgery via modified_headers in FollowRedirect

Bug: AreRequestHeadersSafe() in header_util.cc does not block Origin or Sec-Fetch-* headers in modified_headers. A compromised renderer can forge these on cross-origin redirects.

Impact 1: Origin header forged to match victim — CSRF protection bypassed.
Impact 2: Sec-Fetch-Site forged to "same-origin" — Fetch Metadata resource isolation bypassed.

Test 1: Sec-Fetch-Site Forgery (GET redirect)

Fetch from localhost:8080 redirects (302) to 127.0.0.1:8081.
Expected (normal): Sec-Fetch-Site: cross-site
Actual (patched): Sec-Fetch-Site: same-origin (FORGED)

Click button to run...

Test 2: Origin Header Forgery (POST 307 redirect)

POST from localhost:8080 redirected (307) to 127.0.0.1:8081.
Expected (normal): Origin: null (cross-origin redirect nullifies Origin)
Actual (patched): Origin: http://127.0.0.1:8081 (FORGED to match victim)

Click button to run...

Test 3: Both Forgeries Combined