Send the client's credentials and proxy target on a stream request

open_stream(), and with it stream::Get() and SSEClient, wrote its own
request head and left out what a buffered request gets: the
Authorization from set_basic_auth() or set_bearer_token_auth(), and
through a plain HTTP proxy the absolute-form target (RFC 9112 3.2.2)
and Proxy-Authorization. A proxy refused such a request, and an origin
that needs credentials answered 401.

Move the two decisions out of write_request() and handle_request() into
add_credential_headers() and proxy_target_prefix(), and use them in
open_stream() too, after connecting as a buffered request does. A
Digest challenge or a redirect is still handed to the caller.

test/test_proxy.cc

@@ -361,6 +361,19 @@ TEST(KeepAliveTest, SSLWithDigest) {
 
 // ----------------------------------------------------------------------------
 
+// The proxy needs the absolute-form target and its credentials, the origin
+// its own
+TEST(ProxyTest, NoSSLOpenStream) {
+  Client cli("httpbin");
+  cli.set_proxy("localhost", 3128);
+  cli.set_proxy_basic_auth("hello", "world");
+  cli.set_basic_auth("hello", "world");
+
+  auto handle = cli.open_stream("GET", "/basic-auth/hello/world");
+  ASSERT_TRUE(handle.response);
+  EXPECT_EQ(StatusCode::OK_200, handle.response->status);
+}
+
 #ifdef CPPHTTPLIB_SSL_ENABLED
 TEST(ProxyTest, SSLOpenStream) {
   SSLClient cli("httpbin");