libcurl: effective URL option can leak credentials not present in input

libcurl could return a URL from curl_easy_getinfo() with the CURLINFO_EFFECTIVE_URL option that contains credentials, even though neither the original URL nor the redirect target contained them. An application that reads this value and logs, stores or displays it could expose those credentials.

Summary written from the sources below. Check the originals before acting.