Credential disclosure via stale auth callback URL

Information disclosure in libgit2 before 1.8.6 and 1.9.0 through 1.9.4 allows remote attackers to leak HTTP credentials via redirects. The built-in HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, then passes the original remote URL instead of the redirected host URL into the credential callback after a 401 challenge, so returned credentials are cached for and sent to the redirect target in an Authorization header. Exploitation requires control of a trusted Git host or an open redirect on that host and an application callback that scopes HTTP Basic or token credentials to the original URL.