fix(http task): add cookie jar to http.Client

[snehalahire-pattern]

Summary

• Add Jar: cookiejar.New(nil) to both http.Client constructions in internal/pkg/pipeline/task/http/http.go (the default getClient() and the proxy-override path)
• Fixes Amazon Seller Central redirect-cookie auth flows that previously hit Go's 10-redirect cap because Set-Cookie headers issued mid-redirect were discarded
• Jar is per-httpCore-instance (request-scoped), so no cross-task cookie leakage

Root cause

http.Client{} was built with Jar == nil. Amazon's auth flow returns a 302 with a Set-Cookie and expects the client to store and replay it on the next hop. With no jar, Go's client dropped every Set-Cookie and re-sent only the static Cookie header — Amazon kept redirecting to set the missing cookie → 10-redirect loop → failure.

Behavior delta

• Before: any Set-Cookie from any HTTP task response was silently dropped.
• After: cookies honored per RFC 6265. For non-redirect flows that happen to return Set-Cookie, the cookie will now be sent on subsequent requests to the same domain within the same task invocation. This is a correctness improvement (standard cookie semantics), not a regression — no grep'd consumer depends on the previous broken behavior.

Test plan

• go build ./... — clean
• go vet ./... — clean (pre-existing warnings in compress.go/archive.go/file.go unrelated)
• go test ./... — passes (ok internal/pkg/pipeline)
• Manual verification: run amazon_advertising_deals_data.yaml submit_download_request in staging against Seller Central and confirm no stopped after 10 redirects error

Refs: DATA-8676

🤖 Generated with Claude Code