Prepare SDK 2.0: fix HTTPS, authentication, and API request paths

[overtrue]

Summary

• Default to HTTPS, honor configured base URI, and resolve documented /mail/send endpoints under the API base path.
• Put POST authentication in URL-encoded or multipart fields; retain query parameters, special characters, payloads, response modes, exceptions, and async behavior.
• Disable redirect following by default. Explicitly enabled redirects must remain on the initial origin; validate before transport or a caller redirect callback.
• Replace obsolete PSR-7 request modification and add 74 mocked outgoing-request regressions plus lint/audit CI.

SemVer: proposed 2.0.0

This is intentionally a new major:

• PHP minimum becomes 7.2.5 and Guzzle minimum 7.15.2 (7.x only).
• Leading-slash endpoint resolution now follows the documented SDK API path; absolute URLs retain Guzzle behavior.
• Redirect following becomes opt-in and origin-restricted.
• Prebuilt multipart bodies and low-level HTTP-client multipart calls are rejected. Use the SDK upload() or request() multipart option so authentication fields can be replaced before encoding.

Require overtrue/http 1.2.3: tags 1.2.1 and 1.2.2 fix PHP 8 collection loading but still convert resource uploads to booleans; 1.2.3 is the first release with both corrections. No changes are made to overtrue/http itself or response semantics.

Current Composer advisory checks reject the legacy Guzzle 6/PHP 7.0 combination. No audit bypasses or advisory exceptions were used.

Verification

• Original SDK fails 11 of the first 21 regressions; patched SDK now has 74 passing regressions.
• Final 74-test suite passes natively on PHP 8.2.32 and 8.4.24 with both lowest and latest audited dependencies.
• Lowest set: Guzzle 7.15.2 / PSR-7 2.13.0 / overtrue/http 1.2.3. Latest set: Guzzle 7.15.5 / PSR-7 2.13.1 / overtrue/http 1.2.3.
• Composer strict validation, audit, PHP syntax lint, and git diff checks pass.
• PHP 7.2.5 platform dependency resolution passes; this is not native execution. CI covers every declared current minor: PHP 7.2–7.4 and 8.0–8.5, with lowest/latest dependencies.
• Existing overtrue/http collection/nullable-parameter deprecations remain visible; no suppression or unrelated dependency-source edits.
• MockHandler replaces only the transport, retaining actual authentication and redirect middleware. Synthetic credentials only; no live SendCloud calls or emails.
• Redirect regression coverage includes 302/307/308, GET/form/multipart, cross-host/downgrade/port/protocol-relative destinations, async failures, safe same-origin multipart, and custom base origins. Empty registries and duplicate test names fail.

API sources

• https://www.sendcloud.net/doc/en/email_v2/send_email/
• https://www.sendcloud.net/doc/en/email_v2/apiuser_do/

Final verification

• Head de7486f9dc8d45ec44d641ac2fce8d43c9eaaf4d: all 18 CI jobs passed, including native PHP 7.2 lowest/latest.
• Tested local tree, remote head tree, and CI merge tree all equal e7ce2274e29606168de14a0a7cd80319a5621d5e.
• Independent code review and negative-case retesting completed with no remaining blocking findings. The narrow final change preserves explicit form Content-Type parameters.

Kept in draft for the release decision; no merge or release has been performed.