curl cross-origin HTTPS redirect reuses TLS client certificate for unintended second-origin mTLS authentication

Summary: When curl follows an HTTPS redirect to a different origin under normal `-L` / `CURLOPT_FOLLOWLOCATION` behavior, it still presents the configured TLS client certificate to the redirected-to HTTPS server. This happens without `--location-trusted` / `CURLOPT_UNRESTRICTED_AUTH`, even though …

set -euo pipefail

ROOT="$PWD"
CURL_BIN="$ROOT/src/.libs/curl"

if [ ! -x "$CURL_BIN" ]; then
  echo "expected a built curl binary at $CURL_BIN" >&2
  exit 1
fi

command -v python3 >/dev/null 2>&1 || {
  echo "python3 is required" >&2
  exit 1
}

command -v openssl >/dev/null 2>&1 || {
  echo …