CVE-2026-25679: fix insufficient validation of host/authority in url.Parse
that allowed invalid URLs; strengthen parsing and reject malformed host and
authority components
fix-smtp-test-expired-cert: fix expired TLS test certificate in net/smtp tests;
replace with upstream long-lived cert