Following on from bug#61916, there was one variable I missed that should
also have a faux-dynamic binding: url-max-redirections.

To demonstrate:

(setq url-debug t) ;; and follow the results in the *URL-DEBUG* buffer
(setq url-max-redirections 30) ;; the default

(let ((url-max-redirections 0))
  (url-retrieve "http://httpbin.org/redirect/5"
    #'(lambda (&rest _args)
        (message "done"))))

This will cause 5 redirections to be followed by url-http.el, because it
still sees url-max-redirections as 30.

With the attached patch it stops after the first redirection.

-- 
...Peder...