url: change hostname regex to negate invalid chars

Fixes joyent/node#8520

This changes hostname validation from a whitelist approach to a 
blacklist approach as described in https://url.spec.whatwg.org/#host-parsing.

From the issue:
> url.parse misinterpreted `https://good.com+.evil.org/`
> as `https://good.com/+.evil.org/`.  If we use url.parse to check the
> validity of the hostname, the test passes, but in the browser the
> user is redirected to the evil.org website.