fix(profile): reject unsafe shared interceptors

Author: loong10k

src/main/java/io/github/easy4j/hermes/HermesClient.java

@@ -1103,6 +1103,12 @@ public HermesClient forProfile(ProfileBinding binding) {
         if (!isHttpEnabled()) {
             throw new IllegalStateException("Hermes HTTP client is disabled");
         }
+        if (ownedHttpClient == null
+                && (!sharedHttpClient.interceptors().isEmpty()
+                || !sharedHttpClient.networkInterceptors().isEmpty())) {
+            throw new IllegalStateException(
+                    "Cannot prove profile isolation for an externally managed OkHttpClient with interceptors");
+        }
         String profileId = normalizeProfileId(binding.getProfileId());
         String cacheKey = config.getHttp().getBaseUrl() + "|" + profileId + "|" + binding.getCredentialIdentity();
         return profileClients.computeIfAbsent(cacheKey, ignored -> createProfileClient(binding, profileId));