spec: conform to latest WHATWG URL Pattern WPT test data

Refresh testdata/urlpatterntestdata.json from the current WPT snapshot
(365 cases, up from 313) and align the implementation with the new
expectations:

- createComponentMatchResult now bounds iteration by the group name
  list length so user-provided regex groups (e.g. :foo((?<x>a))) no
  longer index past the name list and panic. Groups without a name
  are simply not exposed on result.Groups, matching WPT test 364.
- canonicalizeHostname: drop the broad reject-on-'/ ? # \\' guard.
  The URL parser now canonicalizes those boundary chars correctly;
  keep only the ':' check since without it "bad:hostname" would be
  silently split into host + port.
- hostnameParser: drop WithFailOnValidationError so tab/LF/CR in a
  hostname are stripped per the WHATWG URL spec instead of errored.
- canonicalizePort: rewritten to
    1. skip leading ASCII tab / LF / CR and require the first
       significant byte to be a digit (to reject "invalid80"),
    2. always parse against a non-special scheme when no protocol
       is supplied so the library doesn't collapse default ports
       like 80/443 to empty,
    3. remove the former "portValue != canonicalized" rejection
       which also rejected valid canonicalizations like "8\t0" -> "80"
       and "80x" -> "80" (state-override truncation).

All 365 WPT cases pass (2 skipped for advanced unicode features Go's
regexp engine does not support).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dunglas

parser.go

@@ -27,7 +27,7 @@ var DefaultPorts = map[string]string{
 }
 
 var urlParser = url.NewParser()
-var hostnameParser = canonicalizer.New(url.WithFailOnValidationError(), canonicalizer.WithDefaultScheme("http"))
+var hostnameParser = canonicalizer.New(canonicalizer.WithDefaultScheme("http"))
 
 var (
 	NonEmptySuffixError      = errors.New("suffix must be the empty string")
@@ -420,10 +420,12 @@ func canonicalizeHostname(hostnameValue, protocolValue string) (string, error) {
 		return hostnameValue, nil
 	}
 
-	// Dirty workaround for https://github.com/whatwg/urlpattern/issues/206
-	if hostnameValue[:1] != "[" {
+	// Non-IPv6 hostnames must not contain ':': without this guard, the URL
+	// parser would split "host:port" into host and port, silently accepting
+	// patterns like "bad:hostname" as a plain hostname.
+	if hostnameValue[0] != '[' {
 		for _, c := range hostnameValue {
-			if c == '/' || c == '?' || c == '#' || c == ':' || c == '\\' {
+			if c == ':' {
 				return "", errors.New("invalid hostname")
 			}
 		}
@@ -462,38 +464,41 @@ func canonicalizePort(portValue, protocolValue string) (string, error) {
 		return portValue, nil
 	}
 
-	var (
-		u   *url.Url
-		err error
-	)
-
-	if protocolValue == "" {
-		u = hostnameParser.NewUrl()
-	} else {
-		u, err = hostnameParser.Parse(protocolValue + "://dummy.test")
-		if err != nil {
-			return "", err
+	// The WHATWG port state strips ASCII tab / LF / CR before examining the
+	// first code point, so reject inputs whose first significant byte is not
+	// an ASCII digit (e.g. "invalid80"). Without this the URL library returns
+	// an empty port instead of failing.
+	firstDigit := false
+	for i := 0; i < len(portValue); i++ {
+		c := portValue[i]
+		if c == '\t' || c == '\n' || c == '\r' {
+			continue
 		}
+		firstDigit = c >= '0' && c <= '9'
+		break
+	}
+	if !firstDigit {
+		return "", InvalidPortError
 	}
 
-	u, err = hostnameParser.BasicParser(portValue, nil, u, url.StatePort)
+	scheme := protocolValue
+	if scheme == "" {
+		// Use a non-special scheme so the URL parser does not treat a
+		// well-known default port (http/80, https/443, ...) as empty.
+		scheme = "urlpattern-non-special"
+	}
+
+	u, err := urlParser.Parse(scheme + "://dummy.test")
 	if err != nil {
 		return "", err
 	}
 
-	p := u.Port()
-
-	// This looks like a bug in the spec ("80 " should be considered valid), but there is a test covering this
-	// Another dirty workaround
-	if p != portValue {
-		if dp, ok := DefaultPorts[protocolValue]; ok && portValue == dp {
-			return p, nil
-		}
-
-		return "", InvalidPortError
+	u, err = urlParser.BasicParser(portValue, nil, u, url.StatePort)
+	if err != nil {
+		return "", err
 	}
 
-	return p, nil
+	return u.Port(), nil
 }
 
 // https://urlpattern.spec.whatwg.org/#canonicalize-a-pathname