Fix #81122: SSRF bypass in FILTER_VALIDATE_URL

We need to ensure that the password detected by parse_url() is actually
a valid password; we can re-use is_userinfo_valid() for that.