XRAY-156301 Implement http HEAD GET security for pip and poetry

[Phavya-jfrog]

• The pull request is targeting the dev branch.
• The code has been validated to compile successfully by running go vet ./....
• The code has been formatted properly using go fmt ./....
• All static analysis checks passed.
• All tests have passed. If this feature is not already covered by the tests, new tests have been added.
• Updated the Contributing page / ReadMe page / CI Workflow files if needed.
• All changes are detailed at the description. if not already covered at JFrog Documentation, new documentation have been added.

Pip and Poetry curation requests followed redirects with no host validation, so a malicious/compromised package index could redirect a request off-repo and still get the auth token. Pipenv already had this fixed; this PR just extends the same protection to Pip and Poetry.

No new logic — reuses Pipenv's existing bounded-redirect mechanism.

---