Fix :cve:`2026-15806` by scoping :class:`~urllib.request.HTTPPasswordMgr`
credentials to the URL scheme, preventing credentials stored for an HTTPS
URL from being used for a matching HTTP URL, while URIs without a scheme
continue to match any scheme.
