Wget Basic auth helper uses sprintf into fixed stack buffer

In the HTTP Basic authentication helper, [REDACTED] are concatenated into a 256-byte stack buffer with sprintf after only a loose length check. The code assumes the combined credential length will fit, but the actual write also needs space for the colon and NUL terminator, and the destination is still a fixed-size stack array on the short path.