CVE-2026-86409: stale SigV4 headers sent unintended

Setting `CURLOPT_AWS_SIGV4` to `NULL` returns `CURLE_OK` but does not disable SigV4 authentication. The handler in `lib/setopt.c` clears the parameter string (`STRING_AWS_SIGV4`) but never removes the `CURLAUTH_AWS_SIGV4` bit from `data->set.httpauth`. A subsequent `curl_easy_perform()` on the same …

case CURLOPT_AWS_SIGV4:
    result = Curl_setstropt(data, STRING_AWS_SIGV4, ptr);
    if(CURL_EASY_STR(data, STRING_AWS_SIGV4))
      s->httpauth = CURLAUTH_AWS_SIGV4;
    break;