validate the scheme against the RFC 3986 grammar

[Samin061]

What do these changes do?

URL.build(scheme=...) and URL.with_scheme() write the caller-supplied scheme into the URL without checking it against the RFC 3986 scheme grammar, and a scheme is never escaped, so a delimiter in it restructures the rendered URL. URL('http://good.example/p').with_scheme('http://evil.example') renders as http://evil.example://good.example/p, which parses back to host evil.example while the object it came from still reports good.example; the same holds for URL.build. Both entry points now run the scheme through ALPHA *( ALPHA / DIGIT / "+" / "-" / "." ) before it is stored, which is where the host subcomponent is already validated.

Are there changes in behavior for the user?

Yes. A scheme outside the RFC 3986 grammar now raises ValueError instead of producing a URL that renders differently than it parses. An empty scheme still means a relative URL, and encoded=True still skips validation, matching how host is handled.

Is it a substantial burden for the maintainers to support this?

No, it is one grammar check shared by the two unencoded entry points.

Related issue number

None.

Checklist

• I think the code is well written
• Unit tests for the changes exist
• Documentation reflects the changes
• If you provide code modification, please add yourself to CONTRIBUTORS.txt (N/A, no such file in this repo)
• Add a new news fragment into the CHANGES/ folder