Fetch a URL, following redirects manually so the SSRF guard re-validates and
re-pins each hop (closing the DNS-rebinding window for redirected hosts too),
retrying transient failures with exponential backoff. Caps the redirect
chain at [MAX_REDIRECTS], the body at
webfetch_core::http::MAX_BODY_BYTES, and the whole operation at
[TOTAL_BUDGET_MULTIPLIER] times timeout_secs.