Incomplete IDN hostname check on the transfer path can lead to credential disclosure to an unintended host

The fix that rejects URL-separator characters introduced by IDN decoding (`hostname_check()` after `host_decode()`) was applied only to the `curl_url_get()` getter path. The transfer path still IDN-decodes the URL host with libidn2 and stores the result without any `hostname_check()`. Because …

import socket,threading,sys
L=('127.0.0.1',int(sys.argv[1])); LOG=sys.argv[2]
def log(m): open(LOG,'a').write(m+'\n'); print(m,flush=True)
def h(c):
    b=b''
    while b'\r\n\r\n' not in b:
        d=c.recv(4096)
        if not d: return
        b+=d
    line=b.split(b'\r\n',1)[0].decode(); …