CVE-2026-80255: secure cookie attribute bypass with tab

A `Set-Cookie` header using HTAB (horizontal tab) instead of SPACE before the `Secure` attribute — e.g. `Set-Cookie: sid=SECRET;\tSecure` — causes curl to store the cookie without its Secure flag. The cookie is then sent over plaintext HTTP on subsequent requests to the same host.

do {
    if(!curlx_str_cspn(&ptr, &name, ";\t\r\n=")) {
        // parse attribute
    }
} while(!curlx_str_single(&ptr, ';'));