Function guarded_get 

pub async fn guarded_get(
    client: &Client,
    url: &str,
    extra_headers: &[(HeaderName, HeaderValue)],
) -> Result<Response>

Fetch a user-supplied URL through the full SSRF guard: scheme + IP checks on the initial URL and on every redirect hop, following redirects manually.

The passed client is used only as a policy reference; each hop is actually sent through a freshly-built pinned_client whose DNS for the target host is pinned to the exact IP that just passed resolve_and_check — so the connect can’t be rebound onto an internal address between the check and the TCP handshake.

extra_headers are applied to every hop (e.g. the conditional-GET If-None-Match / If-Modified-Since validators) — except credential headers (Authorization, Cookie, …), which are dropped the moment a redirect leaves the original origin, mirroring what reqwest’s own redirect policy does for the shared client (see hop_headers). Returns the final Response (headers only; the body is read separately via read_capped). Err on a blocked scheme/address, an exhausted redirect budget, or a transport error.