topdown: Specify host verification policy for http redirects

Currently if http redirects are enabled, we use the client's default
redirect policy. We should instead check if the hosts http.send
calls as part of the redirect are explictly allowed by the policy
authors. This change updates the http client's CheckRedirect policy
to verify the hosts the client calls when redirects are enabled.

Fixes: #5388

Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>