fix: add default timeout and handle errors for HaveIBeenPwned API (#39316)

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

modules/lfstransfer/backend/util.go

@@ -127,7 +127,7 @@ func isInternalLFSURL(s string) bool {
 	return true
 }
 
-func newInternalRequestLFS(ctx context.Context, internalURL, method string, headers map[string]string, body any) *httplib.Request {
+func newInternalRequestLFS(ctx context.Context, internalURL, method string, headers map[string]string, body any) *httplib.ClientRequest {
 	if !isInternalLFSURL(internalURL) {
 		return nil
 	}