tool_operate: drop the scheme-guessing in the -G handling

Prior to this, -G would override the scheme set with --proto-default and
revert back to guessing the scheme based on the hostname.

Add test 2008 to verify the fix

Spotted by Codex Security

Closes #20992

src/tool_operate.c

@@ -847,7 +847,8 @@ static CURLcode append2query(struct OperationConfig *config,
       char *updated = NULL;
       uerr = curl_url_set(uh, CURLUPART_QUERY, q, CURLU_APPENDQUERY);
       if(!uerr)
-        uerr = curl_url_get(uh, CURLUPART_URL, &updated, CURLU_GUESS_SCHEME);
+        uerr = curl_url_get(uh, CURLUPART_URL, &updated,
+                            CURLU_NO_GUESS_SCHEME);
       if(uerr)
         result = urlerr_cvt(uerr);
       else {

tests/data/Makefile.am

@@ -245,6 +245,7 @@ test1970 test1971 test1972 test1973 test1974 test1975 test1976 test1977 \
 test1978 test1979 test1980 test1981 \
 \
 test2000 test2001 test2002 test2003 test2004 test2005 test2006 test2007 \
+test2008 \
 \
                                                                test2023 \
 test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \

tests/data/test2008

@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+-G
+--proto-default
+</keywords>
+</info>
+
+# Server-side
+<reply>
+<data crlf="headers">
+HTTP/1.1 200 OK
+Content-Length: 6
+Funny-head: yesyes
+
+-foo-
+</data>
+</reply>
+
+# Client-side
+<client>
+<features>
+proxy
+</features>
+<server>
+http
+</server>
+<name>
+-G with --proto-default=http and scheme-less URL starting with "ftp"
+</name>
+<command>
+ftp.test --proto-default=http --resolve ftp.test:80:%HOSTIP -G -d hello -x http://%HOSTIP:%HTTPPORT/
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<protocol crlf="headers">
+GET http://ftp.test/?hello HTTP/1.1
+Host: ftp.test
+User-Agent: curl/%VERSION
+Accept: */*
+Proxy-Connection: Keep-Alive
+
+</protocol>
+</verify>
+</testcase>