Merge commit from fork

Protocol-relative URLs (e.g. `//evil.com/path`) bypassed the existing
relative-URL guard in `build_exclusive_url`, allowing an attacker-controlled
URL to override the connection's base host. The `//` prefix matched the
`/` check in `start_with?`, so these URLs were passed through to
`URI#+` which treated them as authority references, replacing the host.

Extend the guard condition so that URLs starting with `//` are also
prefixed with `./`, neutralising the authority component and keeping
requests scoped to the configured base host.

Security: GHSA-33mh-2634-fwr2

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>