fix: close the critical and high review findings

[guillaumegay13]

✨ What changed

• Capturing a failed response stops after 1 s (httpx, requests, aiohttp, urllib), the rest stays with the caller
• A retry with a new body drops transfer-encoding, so it never carries two framings
• A failed install (a bad HTTPS_PROXY, say) is rolled back with a warning, the app keeps running
• A patched retry URL goes through the allowlist and denylist
• Filter paths are compared decoded, with . and .. resolved

💭 Why

Findings from a full-repo review (High). A server trickling a 4xx could stall a streaming caller, and /v1/%73ecret got past a /v1/secret deny rule.

📝 Notes

tests/fixtures/url-filter.json gained encoded-path cases, the same in node, python and php.
Credential masking findings are left for mnfst/http-redact.