Backport to 3.x: adapt to pre-normalizeQueryFragmentEncoding codebase by
adding encodeComponent/encodeQuery/encodeFragment/encodeUserinfo helpers
directly to lib/utils.js.

Co-authored-by: Antonio Tripodi <Tony133@users.noreply.github.com>

Co-authored-by: Antonio Tripodi <Tony133@users.noreply.github.com>

RFC 3986 §6.2.2 case/percent normalization was applied to the path but
not to the query or fragment:

- the query was passed through verbatim, so `?a=%2a` was not uppercased to
  `?a=%2A`, `%7e`/`%2e` were not decoded, and a raw space or non-ASCII
  byte was left unencoded;
- the fragment went through `encodeURI(decodeURIComponent(...))`, which
  decodes reserved characters too — `#a%2Fb` became `#a/b`, changing the
  value.

Add `normalizeQueryFragmentEncoding` (the path normalizer with the
query/fragment character set, which also allows `?` and decodes `.`) and
route both components through it, so all three are normalized the same way.

A fragment whose decoded bytes are not valid UTF-8 (e.g. `#%E0%A4A`) is
still valid percent-encoding (RFC 3986 §2.1 is byte-level) and is now
preserved instead of being flagged as malformed.

Backport to 3.x as a prerequisite for the malformed percent-encoding and
component serialization hardening fixes.

Path serialization used the deprecated escape()-style safe set, which
rewrote literal reserved path characters into percent escapes (a;b ->
a%3Bb) and turned existing %3A escapes into live colons (a%3Ab -> a:b)
via a blanket split('%3A').join(':'). Per RFC 3986 a percent-encoded
reserved character is not equivalent to its literal form, so both
rewrites changed route params, matrix params, and cache keys.

Serialize paths against the RFC 3986 path grammar instead: literal
reserved path characters stay literal and existing percent escapes are
preserved as data. Path-noscheme handling is retained by escaping only
literal ':' when no scheme is present.

Closes GHSA-7mh8-fcmq-x23c.

* fix: preserve URI component case in equality

* test: cover malformed object equality

* fix: reject malformed IPv6 literals

* fix: restore RFC 5952 zero-run compression for IPv6 hosts

The IPv6 validation rewrite stripped per-hextet leading zeros but no longer
applied "::" zero-run compression, so normalize() was not RFC 5952 canonical
and equal() returned false for the same address across expanded and compressed
forms (e.g. [0:0:0:0:0:0:0:1] did not equal [::1]). That makes equal()-based
host checks representation-sensitive.

- add compressIPv6ZeroRun (longest run, leftmost on ties, minimum length 2)
- expand "::" before recompressing so the result is canonical regardless of
  where the input placed "::"
- add IPv6 canonical/equal tests; update the all-zeros normalize expectation

---------

Co-authored-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>

The mailto scheme handler was added in v4 (#195). Use the existing ws
scheme to verify the same behavior.

A bracketed host with a malformed zone identifier (e.g. [fe80::1%25]) is
not an IP per parse, so canonicalizeHost fell through to the WHATWG
fallback. Node >= 18 throws there (fail-closed), but Node 16's URL parser
accepts the input and .hostname strips the brackets, truncating the
malformed literal. Skip hosts starting with '[' — IDN conversion only
applies to reg-names.

Signed-off-by: Matteo Collina <hello@matteocollina.com>

(cherry picked from commit e008152)

* Merge commit from fork

(cherry picked from commit 820e847)

* Merge commit from fork

(cherry picked from commit 506b155)

Signed-off-by: Matteo Collina <hello@matteocollina.com>