Http final readonly class

Outgoing HTTP, a client handed to the code that uses it. An extension finds one on $minn->http, bound to the hosts its minn.json asks for under needs.http; an engine class takes one in its constructor, the real network unless a test passes a fake's:

$data = $minn->http->get('https://api.example.com/status')->json(); $this->http->post($url, json: ['email' => $email], timeout: 10)->throw();

Every verb answers with an Exchange (->ok(), ->failed(), ->json(), ->header(), ->cookie(), ->throw(), ->code, ->body) and takes the same named arguments, each optional:

- `query`: array added to the URL's query string - `headers`: `name => value` (a list value repeats the header), or "Name: value" lines - `json`, `form`, `body` (post, put, patch): an array sent as JSON, an array form-encoded, or a string sent as it is; one of the three, and the first two set the Content-Type - `timeout`: seconds for the whole exchange, 5 by default - `redirects`: how many to follow, 5 by default; 0 hands back the 3xx - `hosts`: URL prefixes every hop must start with (`['https://api.github.com/']`) - `private`: hosts allowed to reach a private address. Loopback, LAN, link-local and cloud-metadata addresses are refused otherwise, at every hop and after DNS, so a URL someone typed is safe to fetch - `maxBytes`: the largest body accepted; a longer one fails the exchange - `userAgent`: Minn/{version} by default

A misspelt argument is an error at the line that has it. Credentials (Authorization, Cookie) are dropped when a redirect leaves the origin. A fake (new Http\Fake([...])->http()) answers only the client it made, so a test shares nothing with the rest of the process.