security: pingntlm forces InsecureSkipVerify and re-sends Basic auth on every redirect #32

Found by the security second review of #11 on 2026-10-20. This is pre-existing and wasn't introduced by #11.

• pkg/provider/pingntlm/pingntlm.go:81-86 hard-codes InsecureSkipVerify: true in Authenticate. That overrides the account's SkipVerify, so TLS verification is always off on the NTLM path.
• CheckRedirect re-applies SetBasicAuth on every redirect, whatever the target host, so credentials can be sent to a redirect target on a different host.

Severity: Medium. Fix: honour SkipVerify, and send Basic only to the original host.