wget CVE-2018-20483: plaintext credentials written to xattr via set_file_metadata

wget stores the full origin URL (including embedded credentials like user:password) into POSIX extended file attributes when --xattr is enabled (default when ENABLE_XATTR is compiled in). Any user or process with read access to the file can retrieve credentials from the xattr user.xdg.origin.url. Affects FTP and HTTP downloads with credentials in the URL.