wget src/http.c: [redacted:auth-header] stack buffer sizing depends on len1 check

Refined evidence: src/http.c [redacted:auth-header] computes [REDACTED], chooses buf_t1 when len1<256, then performs [REDACTED]. The exact safety condition for sprintf is sensitive to whether len1 includes/omits the final NUL and the ':' byte, so the existing stack/heap boundary is fragile and can lead to stack-buffer overflow on crafted credentials.