[core] deeper sanitization of sensitive headers during cross-origin redirects

[xirzec]

Currently we only remove the authorization header here:

azure-sdk-for-js/sdk/core/ts-http-runtime/src/policies/redirectPolicy.ts

Line 94 in e27a676

request.headers.delete("Authorization");

Looking around in the repo I found a few other headers we might want to clean up like

Ocp-Apim-Subscription-Key
subscription-key
api-key
x-api-key

I'm not sure if any services are currently relying on redirect behavior in a way that would stop working with simply removing all of them.

[jeremymeng]

x-ms-authorization-auxiliary is another key to clean up