httpext: digest auth loses credentials when a script reuses a shared `http.url` object

preq.URL.GetURL().User = nil in lib/netext/httpext/request.go reads the username/password for the digest handshake from the request URL's userinfo, then nulls it out. But httpext.ToURL() can return the same *url.URL pointer on every call, so if a script builds a URL once and reuses it:

const target = http.url`http://user:pass@host/api`;
export default function () {
  http.get(target, { auth: 'digest' }); // 1st call: reads user/pass from target, then nulls target's userinfo
  http.get(target, { auth: 'digest' }); // 2nd call: target's userinfo is already nil, so username/password are read as "" this time
}

k6 has no other way to supply digest credentials besides the URL's userinfo, so every call after the first computes its Digest Authorization header with an empty username and gets rejected with a 401 — not because the request is missing auth, but because it's auth'd with the wrong (empty) credentials.

Predates #6381 (same bug existed in the code it replaced), not a regression, just carried forward.

Fix: clone the URL before nulling .User instead of mutating the shared pointer.