fix: prevent host header injection by sanitizing userinfo in Host header

[bjohansebas]

req.hostname / req.host: master (unpatched) vs our version

Host header	master req.hostname	ours req.hostname	master req.host	ours req.host
example.com:3000 (control)	example.com	example.com	example.com:3000	example.com:3000
example.com:notaport	example.com	undefined	example.com:notaport	undefined
[::1]:notaport	[::1]	undefined	[::1]:notaport	undefined
evil.com:fake@legitimate.com:3000	evil.com ⚠️	legitimate.com	evil.com:fake@legitimate.com:3000	legitimate.com:3000
user@example.com	user@example.com ⚠️	example.com	user@example.com	example.com
user:pass@example.com:8080	user ⚠️	example.com	user:pass@example.com:8080	example.com:8080
user@[::1]:8080	user@[ ⚠️	[::1]	user@[::1]:8080	[::1]:8080
a@b@example.com	a@b@example.com ⚠️	example.com	a@b@example.com	example.com
evil.com:x%40legitimate.com	evil.com ⚠️	undefined	evil.com:x%40legitimate.com	undefined
user@	user@ ⚠️	undefined	user@	undefined
X-Forwarded-Host: evil.com:fake@legitimate.com (trust proxy)	evil.com ⚠️	legitimate.com	evil.com:fake@legitimate.com	legitimate.com

ref: https://github.com/expressjs/express/security/advisories/GHSA-rvrq-qj4c-w73v (Note that it was closed because it did not meet our criteria for being considered a vulnerability and will instead be treated as a bug)

[bjohansebas]

cc: @expressjs/express-collaborators @expressjs/security-wg