Protocol-relative URLs (e.g. `//evil.com/path`) bypassed the existing
relative-URL guard in `build_exclusive_url`, allowing an attacker-controlled
URL to override the connection's base host. The `//` prefix matched the
`/` check in `start_with?`, so these URLs were passed through to
`URI#+` which treated them as authority references, replacing the host.

Extend the guard condition so that URLs starting with `//` are prefixed
with `./`, neutralizing the authority component and keeping requests
scoped to the configured base host.

This backport maintains backward compatibility with the 1.x branch's
colon-escaping behavior for opaque URIs like `service:search`.

Security: CVE-2026-25765, GHSA-33mh-2634-fwr2

Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>