curl: IDN decoding inserts authority delimiters and can redirect proxy CONNECT to a different host

IDN decoding can insert authority delimiters: CURLUPUNYCODE output does not round-trip and proxy requests carry an ambiguous authority Summary libcurl's IDN decoder accepts a hostname containing U+FF20 FULLWIDTH COMMERCIAL AT ＠. libidn2's TR46 transitional fallback converts it to ASCII @...