Fix CCTV provider cancellation and credential-safe errors

changelog.d/1228-cctv-ontario-511-key.md

@@ -2,3 +2,5 @@
   free developer key; set `ONTARIO_511_API_KEY` to enable the pack, which is
   otherwise skipped with one log line saying where to get a key
   (quanticsoul4772, #1228).
+- Refuse Ontario catalog redirects and keep credential-bearing URLs and provider
+  exception text out of failure logs; retain the Ontario licence attribution.

changelog.d/1233-tarktee-datex-catalog-hardening.md

@@ -1,4 +1,5 @@
 - Harden the Tarktee (Estonia) DATEX2 camera catalog fetches: refuse redirects,
-  cancel both response streams when either request fails or overflows the 4 MB
+  abort pending siblings and cancel received or late response streams when either
+  request fails before headers or overflows the 4 MB
   byte cap, retain the shared 30 s dual-XML fetch deadline, and deduplicate camera
   IDs before per-pack prioritization (yaka0007, #1233).