Stack disclosure via unterminated macidn buffer

Information disclosure in libcurl 8.8.0 allows attackers to read stack contents through a 256-byte IDN conversion. In curl_url_get(), the mac_idn_to_ascii and mac_ascii_to_idn paths let Apple's converter fill a 256-byte stack buffer without leaving space for a null terminator, so later string handling reads past the buffer. Reachability requires a libcurl build using Apple's macidn backend; the curl command-line tool and builds using other IDN backends are unaffected.