docs: Use correct link syntax, not markdown.

This previously used substring search, which is incorrect, although
unlikely to be a vulnerability because there are no free-form text
fields allowed in this response format.

This ensures we limit the post-decompression size of the body, and not
only the compressed size (which is enforced via the Content-Length
header at header-processing time).

The lack of this check permitted a read of up to 3 bytes past the end
of the string in some cases.

When following a redirect to a different origin (scheme, host, or port),
auth-related headers (Authorization and Cookie) should be stripped to
avoid exposing them to the new host.

This appears to be a recent libcurl change.

Combined changes for release 6.5.6

docs: Add CVE links to 6.5.6 release notes

We previously did a piecemeal reset of the curl object, but missed some
options (and in fact many of these options cannot be unset without
fully resetting the object). This allowed some options to leak between
requests.

Now we use the curl reset method to ensure we catch everything.

curl_httpclient: Reset the curl object before putting it on the freelist