146e341748
Extract NewSSRFSafeTransport and NewSSRFSafeHTTPClientWithTransport so embedding and rerank can reuse one connection pool without allocating a throwaway transport per client. SSRF dial and redirect policies are unchanged; each client still keeps its own timeout.