netrc credentials leaked to a cross-host redirect target on the Basic auth path (not covered by redirect credential protections)

curl's redirect credential-leak protection (the `CURLOPT_UNRESTRICTED_AUTH` off-by-default guarantee, enforced by `Curl_auth_allowed_to_origin()`) covers three credential sources: a custom `Authorization` header, `CURLOPT_USERNAME`/`CURLOPT_PASSWORD`, and cookies. It does **not** cover credentials …

// lib/url.c:2068+  url_set_data_origin_and_creds()
//   parses the redirect URL, updates data->state.origin to the redirect target.
//   data->state.initial_origin is only cleared in Curl_pretransfer (not on redirect).

// lib/url.c:1371+  url_set_data_origin_and_creds() -> …