[PATCH] http: only send bearer if auth is allowed

[PATCH] http: only send bearer if auth is allowed

Verify with test 2006

Closes #20843

Backported-by: Samuel Henrique <samueloph@debian.org>
 * Refresh patch context for lib/http.c
 * Adapt the new tests/data/test2006: reuse the
   existing test486 as the base (similarity-copy in the diff), keep the
   test definition structurally as upstream wants but also drop the two
   now-stale "#" comment lines that already differ between upstream's and
   our test486.

Backported by: Samuel Henrique <samueloph@debian.org>
 * Bookworm 7.88.1: same output_auth_headers() function, just at
   line 793 (offset +97 vs trixie). Apply only the lib/http.c hunk.
 * Drop the test additions: bookworm has neither tests/data/test486
   (which trixie's test2006 was copy-derived from) nor a way to add
   it without pulling in a non-trivial amount of unrelated test
   infrastructure. The security property is the
   Curl_auth_allowed_to_host() guard itself; tests are nice-to-have.

Gbp-Pq: Name CVE-2026-3783.patch