Disable redirects on measurement fetch, and default to loopback device for attestation provider server

[ameba23]

This fixes two minor security issues:

1. The attestation provider server previously defaults to using the unspecified address "0.0.0.0". This provides a footgun where it can easily be exposed externally, providing an attestation oracle. This PR changes the default to the loopback device "127.0.0.1".
2. On fetching measurement policy from remote source, HTTP redirects can make it hard to be sure what the actual source is, and whether http was used when https was specified. This PR disallows HTTP redirects when fetching measurements from a remote source. I checked that measurements.buildernet.org does not use redirection.

[Copilot]

🟢 Approval recommended

No unresolved review issues were identified.

Pull request overview

This pull request hardens measurement-policy retrieval and reduces accidental external exposure of the attestation provider.

Changes:

• Rejects HTTP redirects when fetching measurements.
• Adds redirect regression tests.
• Defaults the provider server to loopback.

File summaries

File	Summary
crates/attestation/src/measurements.rs	Rejects redirects and tests both fetch paths.
crates/attestation-provider-server/src/main.rs	Defaults server binding to 127.0.0.1.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[alexhulbert]

lgtm