Request redirection via bracketed hostname parsing fallback

Improper URL validation in follow-redirects before 1.15.4 allows remote attackers to redirect requests through crafted hostnames. When the native URL constructor rejects a bracketed or otherwise malformed hostname, request() falls back to legacy url.parse(), which can reinterpret the hostname as a different destination. Exploitation requires a consuming application to pass attacker-controlled URLs; the resulting outbound request can bypass host restrictions and disclose responses from unintended services.