Improve HTTP redirect following (#1637)

This implements HTTP redirect following ourselves.

The goal is:

1. All I/O is checked against `--allowed-resources` and
`--allowed-modules`, including HTTP redirects
2. HTTP rewrite rules can affect redirect following
3. HTTP headers can affect redirect following

---------

Co-authored-by: Islon Scherer <islonscherer@gmail.com>

pkl-executor/src/test/kotlin/org/pkl/executor/EmbeddedExecutorTest.kt

@@ -557,7 +557,7 @@ class EmbeddedExecutorTest {
           allowedModules("file:", "package:", "https:")
           allowedResources("prop:", "package:", "https:")
           moduleCacheDir(cacheDir)
-          certificateFiles(FileTestUtils.selfSignedCertificate)
+          certificateFiles(FileTestUtils.selfSignedCertificatePem)
           testPort(server.port)
         }
       }