docs: Use correct link syntax, not markdown.

This previously used substring search, which is incorrect, although
unlikely to be a vulnerability because there are no free-form text
fields allowed in this response format.

This ensures we limit the post-decompression size of the body, and not
only the compressed size (which is enforced via the Content-Length
header at header-processing time).

The lack of this check permitted a read of up to 3 bytes past the end
of the string in some cases.

When following a redirect to a different origin (scheme, host, or port),
auth-related headers (Authorization and Cookie) should be stripped to
avoid exposing them to the new host.

This appears to be a recent libcurl change.

Combined changes for release 6.5.6