Stop a remote server retargeting WSDL2Java's own WSDL fetch

The tool probes an http location for a redirect before parsing, and took the
Location header from any response: a stray header on a 200 redirected it, a
relative target was used unresolved, and Location: file:///etc/passwd aimed the
parse at the developer's filesystem. The redirect is the hostile document's
server talking, not the developer. It is now followed only from a 3xx, only to
http or https, resolved against the document requested; anything else stops
codegen rather than quietly parsing something else. Timeouts added.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>