fix(collector): give Clone an independent http.Client and lock

[Shinku-Chen]

#875

Clone() shallow-copied the parent's *httpBackend, so the clone shared
the parent's *http.Client. That client's CheckRedirect handler is set
in Init() as a closure over the parent Collector, so the clone's
CheckRedirect kept evaluating the parent's AllowURLRevisit and filter
state. Toggling AllowURLRevisit on the clone therefore had no effect
on redirects: a clone with AllowURLRevisit = true still failed with
"already visited" after the first redirect to a URL the parent had
seen. Cloning also reused the parent's *sync.RWMutex, letting clone
and parent contend for the callback-list lock.

Give each clone its own *httpBackend and *http.Client whose
CheckRedirect closure binds to the clone, plus its own *sync.RWMutex.
Transport, cookie jar and Timeout are still shared from the parent
so connection pooling and session cookies continue to flow across
collectors, and LimitRules are kept (the rules themselves are safe to
share because LimitRule.Init is idempotent — the slice header is
copied so per-collector Limit() calls do not race on append). Update
the Clone godoc to spell out what is shared vs independent.

Add TestCloneAllowURLRevisitIndependent: a clone with
AllowURLRevisit = true visits the same redirect endpoint twice. The
test fails with "already visited" on the previous implementation and
passes with the fix; it also asserts the parent's AllowURLRevisit
field is not mutated.

[Shinku-Chen]

same as
#882
#877