[Vitorinox]

Fixes #377
Fixes #567

Vimeo videos with domain-level privacy only return their full oEmbed data (title, author, thumbnail, description) when the request carries a Referer from an allowed domain. Without it, Vimeo answers 200 with a simplified response and "domain_status_code": 403.

What was going on

• Sending the header already works in v4: $embed->getCrawler()->addDefaultHeaders(['Referer' => ...]) adds it to every request, including the oEmbed one. Verified against vimeo.com/api/oembed.json with a real domain-restricted video.
• But CurlDispatcher replaced any Referer with the previous URL every time it followed a redirect (for example http:// to https://). So a caller-provided Referer was lost after the first hop, which is what Embedding domain-level restricted videos from vimeo issue #377 suspected ("is there somewhere in this library which resets the headers/referer?").
• Vimeo referer header #567 also asked how to tell whether the oEmbed data was fetched. That was not documented.

Changes

• CurlDispatcher: a Referer set by the caller is kept on every redirect hop, like browsers do. Without one, each hop still gets the previous URL as before.
• README: "Checking the oEmbed result" (getOEmbed()->all() === []) and "Vimeo videos with domain-level privacy" (how to send the Referer and read domain_status_code).
• CHANGELOG: 4.6.3.

Tests

• CurlClientTest: the explicit Referer survives a 302 (failed before the fix), and the automatic Referer is unchanged when none is set.
• VimeoRefererTest: the crawler Referer reaches the oEmbed endpoint and unlocks the full data; without it the response is the simplified one with domain_status_code 403; a 404 oEmbed response gives all() === [].
• Full suite on PHP 7.4, 8.1, 8.2, 8.3, 8.4 and 8.5 (300 tests, fixtures unchanged) and PHPStan pass locally.