RFC 3986 §6.2.2.1: the scheme is case-insensitive and should be
normalized to lowercase. `parse()` already lowercases the host but kept
the scheme verbatim, so `parse('HTTP://x').scheme` was `'HTTP'` and
`normalize('HTTP://EXAMPLE.com/')` returned `'HTTP://example.com/'` — an
uppercase scheme next to a lowercased host. `equal()` already compares
schemes case-insensitively, and uri-js returns `'http'`.

Lowercase the scheme at parse time, consistent with the host.

Update dependabot setting to reduce unnecessary change and noise.
Ref fastify/fastify#6715

Signed-off-by: KaKa <[email protected]>
Co-authored-by: Antonio Tripodi <[email protected]>

Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* test: cover IDN host canonicalisation

Ref: GHSA-4c8g-83qw-93j6

* fix: canonicalise IDN hosts via WHATWG URL

Ref: GHSA-4c8g-83qw-93j6

Signed-off-by: Matteo Collina <[email protected]>