username/password silently dropped from durable object request urls

Given the following worker:
```js
export default {
fetch(req, env) {
let url = new URL(req.url)
url.username = 'kentonv'
console.log(url.href) // ie, http://kentonv@localhost:8080/
return env.do.get(env.do.newUniqueId()).fetch(url, req)
}
}

export class DO {
fetch(req) {
return new Response(req.url)
}
}
```
The URL returned by the durable object's response does not contain the `username` set in the worker, despite serializing correctly (ie, shows up in `url.href`) inside the worker itself.

It seems as though `username` and `password` are being silently dropped, despite being valid URL components. Ideally URLs would be sent as-is, but if for some unfortunate reason workerd strips them intentionally, fetch should fail in the worker itself before reaching the DO (same as protocol errors a la `fetch_refuses_unknown_protocols`).