Heap-OOB read in urlapi `redirect_url()` via `CURLU_GUESS_SCHEME` + `CURLU_NO_GUESS_SCHEME` flow

We've found an issue in `lib/urlapi.c` where `redirect_url()` reads past the end of a heap buffer when the source URL it operates on lacks a "scheme://" prefix. This is reachable through documented public APIs (`curl_url_set`) when the caller mixes `CURLU_GUESS_SCHEME` with a subsequent …

const char *protsep = base + strlen(scheme) + 3;