Don't follow OSINT HTTP redirects off the scan target

[cursor]

Bug and impact

src/osint.py fingerprint_http never produced technology hits, and once that path actually ran it would follow Location off the authorized origin.

Trigger: any --osint / --full / --ai scan. The inner import urllib.error made urllib a local name, so urllib.request.Request(...) raised UnboundLocalError on every call. The bare except Exception: pass swallowed it, so OSINT always reported an empty technology list.

Second trigger (after the import is fixed, or if someone reorders it): the scan target answers HEAD / with 302 Location: http://169.254.169.254/… (or any RFC1918 neighbor). urllib's default opener follows the redirect and fingerprints the destination — SSRF from the agent plus false stack data.

Root cause

1. import urllib.error inside the function body, after urllib.request.Request, binds urllib as a local and breaks every call.
2. Default urlopen follows 3xx with no same-origin check (same class as Don't follow HTTP redirects off the scan target #24/Don't follow HTTP redirects in vuln_prober fetches #25, but this site was not in those PRs).
3. str(dict(headers)) is Python dict repr and never matches signatures like Server: nginx.

This is not a duplicate of #24 (header/stack/service/web fetchers) or #25 (vuln_prober._http_get).

Fix

• Import ssl / urllib.error at module level.
• Use a no-redirect opener; still read 3xx headers via HTTPError.
• Match Name: value header lines so TECH_SIGNATURES can fire.

Validation

• python3 -m pytest test_osint.py -q — 23 passed (including new redirect + in-scope header tests).
• python3 -m pytest test_osint.py test_security_hardening.py test_active_validation.py -q — 70 passed.
• python3 -m bandit -r src/osint.py --severity-level high — no high findings.