curl: Incomplete IDN hostname check on the transfer path can lead to credential disclosure to an unintended host

Summary The fix that rejects URL-separator characters introduced by IDN decoding hostnamecheck after hostdecode was applied only to the curlurlget getter path. The transfer path still IDN-decodes the URL host with libidn2 and stores the result without any hostnamecheck. Because libidn2 maps U+FF2...