OPA-01-006: http.send follows redirects by default

[tsandall]

The http.send built-in function follows redirects by default which policy authors may not expect, thus leading to unexpected policy evaluation results (especially if the http.send inputs are constructed based on query inputs.)

We should make http.send disable redirects by default and expose an option to allow policy authors to explicitly enable them.