Fix username:password@ validation in urls

[erikdubbelboer]

No description provided.

[Copilot]

Pull Request Overview

This PR fixes username:password@ validation in URLs by changing how the userinfo component is parsed and adding validation to prevent malicious URL parsing attacks.

Key changes:

• Switch from first @ to last @ when parsing userinfo to handle @ symbols in passwords correctly
• Add userinfo validation to reject invalid characters and malformed constructs
• Add comprehensive test coverage for both valid and invalid userinfo scenarios

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
uri.go	Updates parsing logic to use LastIndexByte and adds validUserinfo validation function
uri_test.go	Adds test cases for rejecting invalid userinfo and allowing @ symbols in passwords

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

The validUserinfo function lacks documentation. Add a comment explaining what characters are considered valid for userinfo according to the RFC specification and any security considerations.

Suggested change

	func validUserinfo(userinfo []byte) bool {
	for _, c := range userinfo {
	switch {
	// validUserinfo checks whether the provided userinfo byte slice contains only valid characters
	// as specified by RFC 3986 section 3.2.1. The userinfo component may contain unreserved characters
	// (A-Z, a-z, 0-9, '-', '.', '_', '~'), sub-delimiters ('!', '$', '&', '\'', '(', ')', '*', '+', ',', ';', '='),
	// as well as ':' and '@'. Percent-encoded characters ('%') are also allowed.
	//
	// Security considerations: Proper validation of userinfo is important to prevent injection attacks
	// or misinterpretation of URIs. This function ensures that only valid characters are accepted.
	func validUserinfo(userinfo []byte) bool {
	for _, c := range userinfo {