fix: never run IDN canonicalization on bracketed IP literals

A bracketed host with a malformed zone identifier (e.g. [fe80::1%25]) is
not an IP per parse, so canonicalizeHost fell through to the WHATWG
fallback. Node >= 18 throws there (fail-closed), but Node 16's URL parser
accepts the input and .hostname strips the brackets, truncating the
malformed literal. Skip hosts starting with '[' — IDN conversion only
applies to reg-names.

Author: mcollina

index.js

@@ -351,6 +351,7 @@ function canonicalizeHost (parsed, options, schemeHandler, isIP) {
     !options.unicodeSupport &&
     (!schemeHandler || !schemeHandler.unicodeSupport) &&
     parsed.host &&
+    parsed.host[0] !== '[' &&
     (options.domainHost || (schemeHandler && schemeHandler.domainHost)) &&
     isIP === false &&
     nonSimpleDomain(parsed.host)