net/url: URL.String turns Path into Host when Host is empty, User is non-nil, and Path has no leading slash #81665

The following is an LLM-written summary. The summary seems accurate to me. This was reported to us as a potential security issue. We feel that this is a bug, but we are classifying this as security hardening rather than a vulnerability.

In net/url, (*URL).String writes the //userinfo@ prefix whenever u.User != nil, even if u.Host == "", and only prepends
a leading / to u.Path when u.Host != "" and u.Path does not already begin with /.

As a result, when u.Host == "", u.User != nil, and u.Path does not start with /, u.String() concatenates //userinfo@
directly with u.Path, causing the first segment of u.Path to be parsed as Host if the string is reparsed:

u, _ := url.Parse("example.com/path") // Scheme="", Host="", Path="example.com/path"
u.Scheme = "https"
u.User = url.User("user")

s := u.String() // "https://user@example.com/path"
u2, _ := url.Parse(s)
fmt.Println(u2.Host) // "example.com"

(Related to #78328.)