Wget xattr metadata leaks embedded credentials from URLs

When the optional xattr feature is enabled, Wget stores the full origin URL in user.xdg.origin.url and the referrer URL in user.xdg.referrer.url on the downloaded file. If the URL contains userinfo (for example, [redacted:url-with-credentials] those credentials are written verbatim into a local extended attribute that ordinary local users may read with standard xattr tools.