feat: replace deprecated url.resolve() and url.parse() with WHATWG URL

[dianager]

Pre-Submission Checklist

• Opened an issue discussing these changes before opening the PR
• Ran the linter and tests via make prepush
• Included comprehensive and convincing tests for changes

Issues

Closes:

• Issue #
• Issue #
• Issue #

Summarize the issues that discussed these changes

Changes

Deprecated API Fixes

• url.parse() / url.resolve() — removed in Node.js 24.
• req.getUrl() now returns a WHATWG URL (semver-major)

Breaking chanegs

1. req.getUrl() shape changed — no longer a legacy url.parse() object. .query, .path, .auth, .slashes are gone (silently undefined, no error). Use .searchParams, .pathname + .search, .username/.password instead.
2. req.href()/getHref() is now absolute, not relative (e.g. http://host/foo?a=1 instead of /foo?a=1). Breaks any code comparing it to a relative path.
3. req.path()/getPath() now normalizes the path — collapses ../. segments and converts \ to /. A literal /foo/../bar now returns /bar.
4. Malformed/missing Host header can now throw a TypeError during routing (previously it never mattered for relative URLs). Highest-severity item — recommend adding Host-header validation middleware before upgrading.
5. OPTIONS * requests: req.getUrl().pathname now returns /* instead of * (a bare * can't be represented as a URL). Anything checking req.getUrl().pathname === '' should switch to req.url === ''.

Action for consumers: grep for .getUrl(, .href(, .getHref(, .path(, .getPath(; update stale url.Url type declarations to URL; add Host-header validation; re-run tests (this tends to surface as silently wrong values, not crashes).