Merge commit from fork

Checks the URL scope on every hop of a redirect chain instead of only on the URL requested by the frontend.
Without it, a server on an allowed origin can redirect the request to any other origin - including `localhost` services, internal hosts and cloud metadata endpoints - and the plugin follows it, returning the response to the webview.

plugins/http/guest-js/index.ts

@@ -76,6 +76,10 @@ export interface ClientOptions {
   /**
    * Defines the maximum number of redirects the client should follow.
    * If set to 0, no redirects will be followed.
+   *
+   * When the `scopeRedirects` plugin configuration is enabled, every redirect must
+   * also be allowed by the configured scope, otherwise the request fails
+   * instead of being followed.
    */
   maxRedirections?: number
   /** Timeout in milliseconds */