fix: PwnedValidator cannot reach the HIBP API

[michalsn]

Description
This PR fixes PwnedValidator, which cannot reach the HaveIBeenPwned API on CodeIgniter v4.5.6+. Every password check fails with cURL error 6: Could not resolve host: range.

The validator passed the Guzzle-style base_uri option, while CURLRequest reads baseURI. This worked until v4.5.6, where Services::curlrequest() stopped reading base_uri (codeigniter4/CodeIgniter4#9296). Since then, the base URI is never applied, and the relative path range/<prefix> is treated as a hostname.

Instead of renaming the option key, the request now uses the absolute API URL. This works on every supported framework version, does not depend on the state of the shared curlrequest service, and is verifiable in tests - the existing tests now assert the exact URL sent, so a regression would fail immediately.

Fixes #1371

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide

[datamweb]

LGTM! Thanks.

[michalsn]

Thanks for the reviews, guys! I will be releasing 1.4.1 today.