This feels like configuration creep to me. Is it necessary to expose this through the main config.js file? Does request have a default timeout value that we can use?

The main reason for saying this is that I think it would be useful if this module could work as both a core and contrib module. Depending on how core this functionality becomes, it might end up being one of either.