Validate final URL after redirects in catalog fetch

urlopen follows redirects, so validate the response URL against the
same HTTPS/localhost rules to prevent redirect-based downgrade attacks.

Author: mnriem

src/specify_cli/workflows/catalog.py

@@ -319,21 +319,25 @@ def _fetch_single_catalog(
             except (json.JSONDecodeError, OSError):
                 pass
 
-        # Fetch from URL — validate scheme before opening
+        # Fetch from URL — validate scheme before opening and after redirects
         from urllib.parse import urlparse
         from urllib.request import urlopen
 
-        parsed = urlparse(entry.url)
-        is_localhost = parsed.hostname in ("localhost", "127.0.0.1", "::1")
-        if parsed.scheme != "https" and not (
-            parsed.scheme == "http" and is_localhost
-        ):
-            raise WorkflowCatalogError(
-                f"Refusing to fetch catalog from non-HTTPS URL: {entry.url}"
-            )
+        def _validate_catalog_url(url: str) -> None:
+            parsed = urlparse(url)
+            is_localhost = parsed.hostname in ("localhost", "127.0.0.1", "::1")
+            if parsed.scheme != "https" and not (
+                parsed.scheme == "http" and is_localhost
+            ):
+                raise WorkflowCatalogError(
+                    f"Refusing to fetch catalog from non-HTTPS URL: {url}"
+                )
+
+        _validate_catalog_url(entry.url)
 
         try:
             with urlopen(entry.url, timeout=30) as resp:  # noqa: S310
+                _validate_catalog_url(resp.geturl())
                 data = json.loads(resp.read().decode("utf-8"))
         except Exception as exc:
             # Fall back to cache if available