CVE-2026-3783: token leak with redirect and netrc

Summary When `--oauth2-bearer` is used with `--netrc` and curl follows a redirect, the bearer token leaks to the redirect target. The netrc bypass at `http.c:822` skips `Curl_auth_allowed_to_host()`, allowing the token through. This is an incomplete fix for CVE-2025-14524 — the Dec 2025 SASL fix …

  if(Curl_auth_allowed_to_host(data)
#ifndef CURL_DISABLE_NETRC
     || conn->bits.netrc       // <-- bypasses host check entirely
#endif
    )
    result = output_auth_headers(data, conn, authhost, request, path, FALSE);