CVE-2018-20483: wget leaks HTTP Basic-Auth credentials into user.xdg.origin.url xattr

CVE-2018-20483 (wget <= 1.20): When --xattr is enabled (default on Linux builds with USE_XATTR), wget writes the originating URL of every downloaded file into the POSIX extended attribute user.xdg.origin.url (and the referrer into user.xdg.referrer.url). The URL written is u->url, which was constructed with URL_AUTH_SHOW and therefore contains the cleartext user:password@ from HTTP/FTP Basic-Auth. Because xattrs travel with the file across copies, archives, and shares, any local user or downstream recipient who runs getfattr -d file recovers the secret. Bug class: information-leak / credential disclosure.