[github.com/hashicorp/go-getter] Unsafe downloads in HashiCorp go-getter

HashiCorp go-getter through 2.0.2 does not safely perform downloads. Protocol switching, endless redirect, and configuration bypass were possible via abuse of custom HTTP response header processing.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-30321
• https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
• https://github.com/advisories/GHSA-fcgg-rvwg-jv58