fix: use OR operator in includesCredentials per WHATWG URL Standard

lib/web/fetch/util.js

@@ -1439,7 +1439,7 @@ function hasAuthenticationEntry (request) {
  */
 function includesCredentials (url) {
   // A URL includes credentials if its username or password is not the empty string.
-  return !!(url.username && url.password)
+  return !!(url.username || url.password)
 }
 
 /**

test/fetch/includes-credentials.js

@@ -0,0 +1,24 @@
+'use strict'
+
+const { test } = require('node:test')
+const { includesCredentials } = require('../../lib/web/fetch/util')
+
+test('includesCredentials returns true for URL with both username and password', () => {
+  const url = new URL('http://user:pass@example.com')
+  require('node:assert').strictEqual(includesCredentials(url), true)
+})
+
+test('includesCredentials returns true for URL with only username', () => {
+  const url = new URL('http://user@example.com')
+  require('node:assert').strictEqual(includesCredentials(url), true)
+})
+
+test('includesCredentials returns true for URL with only password', () => {
+  const url = new URL('http://:pass@example.com')
+  require('node:assert').strictEqual(includesCredentials(url), true)
+})
+
+test('includesCredentials returns false for URL with no credentials', () => {
+  const url = new URL('http://example.com')
+  require('node:assert').strictEqual(includesCredentials(url), false)
+})