This is fixed in:
https://github.com/discourse/discourse/commit/eddb8891c410c9f552232c5514c8e0439f5e928b
Now when a post is rebuilt, the cache entries for all links in the post are removed prior to doing the rebuilding.
And here’s a PR for adding a block_onebox_on_redirect site setting:
https://github.com/discourse/discourse/pull/16881
When block_onebox_on_redirect is enabled, Discourse will never onebox URLs that redirect. The only exception to this is if a URL is http and redirects to the https version of the URL. This is done because it’s very common for sites that support TLS to redirect http traffic to https and so the onebox should still work if a user e.g. types out a link with http and the site redirects to https.