* test: cover IDN host canonicalisation

Ref: GHSA-4c8g-83qw-93j6

* fix: canonicalise IDN hosts via WHATWG URL

Ref: GHSA-4c8g-83qw-93j6

Signed-off-by: Matteo Collina <hello@matteocollina.com>

Signed-off-by: Matteo Collina <hello@matteocollina.com>

* fix: reject malformed authority introducer (\, /\, \/) to prevent host-confusion

Adds MALFORMED_AUTHORITY_INTRODUCER regex and check in parseWithStatus()
to detect "\\", "/\", and "\/" used as authority introducers in place
of "//" after the scheme colon. Node's URL treats "\" as interchangeable
with "/" on special schemes, so these inputs would parse as a different
host — an SSRF/redirect bypass gap distinct from the previously-patched
literal-backslash-in-authority fix (GHSA-v2hh-gcrm-f6hx).

Also makes resolve() throw on malformed authority or port, since it
returns a plain string with no error-signal mechanism.

Adds 23 regression tests covering rejection, normalization, equal(),
resolve(), and no false positives.

* fix: reject whitespace-split authority introducer (TAB/LF/CR) host-confusion bypass

---------

Co-authored-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>

Signed-off-by: Matteo Collina <hello@matteocollina.com>