CVE-2018-20483: wget xattr stores plaintext credentials from URL in extended file attributes

When wget downloads a file from a URL containing credentials (e.g., http://user:password@host/file or ftp://user:pass@host/file), it stores the full URL including the plaintext password in the POSIX extended attribute "user.xdg.origin.url" of the downloaded file. This allows any local user with read access to the file to extract plaintext credentials by reading extended attributes (e.g., via getfattr). The xattr feature is enabled by default when wget is compiled with ENABLE_XATTR support.