Allow URLs where username or password contains unescaped '@'. #2985

Discussed in #2984

We don't gracefully handle the case where a @ character is present and unescaped in a URL userinfo/authority section.
I've confirmed that this is a valid issue, and reduced it down to demonstrating against the httpx.URL() API.

Tested the behaviour for Chrome's URL parsing behaviour using username/password against example.com.