wget CVE-2018-20483: xattr leaks URL userinfo (password) to file metadata

wget's set_file_metadata() in src/xattr.c writes the full origin URL (and referrer URL) into POSIX extended attributes user.xdg.origin.url and user.xdg.referrer.url. The URL string used is u->url, which is built via url_string(u, URL_AUTH_SHOW) and therefore preserves embedded userinfo (https://user:password@host/...). Any plaintext credentials passed on the command line, in .netrc, or via --user/--password are persisted as file metadata, readable by any local user with getfattr -d and propagated by cp -a, tar --xattrs, rsync -X.