Public API tightening #1066

Following on from #1065

There's a few attributes that are set in BaseClient.__init__ that look like contenders here for moving into the private API space. Here's what's remaining there...

• self.base_url - Potentially modify this to a property setter / getter style, but not 100% obvious?
• self.auth - Potentially modify this to a property setter / getter style, but not 100% obvious? - See Add Client.auth setter #1185
• self.timeout - Looks like it should definitely move to a property getter / setter style, as per params/headers/cookies.
• self.max_redirects - I think this one is okay as a public attribute, since it's just a plain int.
• self.trust_env - Setting this after __init__ isn't really valid (eg. the transport is already initialized) so we could move it to a read-only property? See client.trust_env becomes read-only #1112
• self.netrc - Ought to be private. See client.netrc should be private #1071