curl: `Curl_socketpair()` fallback vulnerable to man-in-the-middle attack