fix(node): keep master requests on the node they were sent to

The master's node clients followed redirects to any host, presenting the
same panel-wide credentials (the mTLS client certificate) and replaying
the request there, so one node could have the master push to another.
Node clients and the certificate-pin probe now stop at a redirect off
the original host:port and report the 3xx as the node's answer. The
probe change is wiring; TestNodeClientsDoNotFollowARedirectToAnotherHost
covers the guard.

internal/web/service/node.go

@@ -90,6 +90,8 @@ func (s *NodeService) FetchCertFingerprint(ctx context.Context, n *model.Node) (
 			DialContext:     netsafe.SSRFGuardedDialContext,
 			TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, // lgtm[go/disabled-certificate-check]
 		},
+		// The pin must be the certificate of the host asked, not of wherever it redirects.
+		CheckRedirect: runtime.NoCrossHostRedirect,
 	}
 	defer client.CloseIdleConnections()
 	resp, err := client.Do(req)