`url.format()` was stripping username and password credentials from WHATWG
`URL` objects because it was using `Url.prototype.format` which looks for
`this.auth`, but WHATWG URLs store credentials in `username`/`password`.
This fix adds a dedicated `formatWhatwgUrl()` function that properly handles
WHATWG URL objects and supports all format options: `auth`, `fragment`,
`search`, and `unicode`.
Fixes#24343
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
6761760459