RESUMABLE: Clarifying origin and synthesized redirects for upload resources

[guoye-zhang]

Came up during the HTTP workshop, we should provide suggestions for browsers to handle upload resumption as if it's a cross-origin redirect.

[Acconut]

We could reference RFC9110's guidelines on following redirects: https://www.rfc-editor.org/rfc/rfc9110.html#section-15.4-5. It includes security considerations like stripping cookies and authorization headers. Should clients do the same when sending requests to the upload resource for resumption?

Alternatively, or additionally, we could add a security consideration stating that the upload resource might belong to a different origin and that a client has to check if it should requests there and if any information should be omitted.

[guoye-zhang]

SVCB RFC mentions treating the resource record as a 307 redirect: https://datatracker.ietf.org/doc/html/rfc9460#section-9.5-4 Wondering if we should put something similar.