split raw userinfo before decoding redis URI credentials

[insaf021]

redis://us%3Aer:pw@host  ->  getUser="us", getPassword="er:pw"
                             (want user "us:er", password "pw")

getUser/getPassword read uri.getUserInfo(), which percent-decodes the userinfo before the user:password split. A %3A in the username decodes to a literal : first, so split(":", 2) lands on it and the credentials are cut at the wrong point, sending the wrong ACL identity to AUTH.

Splitting uri.getRawUserInfo() keeps the encoded colon as %3A, so only the real separator is a literal :, and each half is decoded after the split. + is kept literal since userinfo is not form data, so passwords already containing + are unaffected.

---

Note

Medium Risk
Touches authentication credential parsing used by all URI-based Jedis connections; behavior changes for URIs with percent-encoded userinfo but fixes incorrect AUTH for those cases.

Overview
Fixes wrong username/password when Redis connection URIs use percent-encoded characters in the userinfo segment (e.g. a colon in the ACL username as us%3Aer).

getUser and getPassword now read getRawUserInfo(), split on the first literal :, then percent-decode each half via a new decode() helper. That avoids getUserInfo() decoding %3A into : before the split, which previously mis-parsed credentials and could send the wrong identity to AUTH. Decoding also treats + as literal in passwords (not form-style space decoding).

Adds unit tests for encoded colons in usernames and encoded specials in passwords.

^{Reviewed by Cursor Bugbot for commit 81845e0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[ggivo]

Thanks for the fix — we'll take a closer look shortly.