url: change hostname regex to negate invalid chars

Regarding joyent/node#8520

This changes hostname validation from a whitelist regex approach
to a blacklist regex approach as described in https://url.spec.whatwg.org/#host-parsing.

From the issue:
> url.parse misinterpreted `https://good.com+.evil.org/`
> as `https://good.com/+.evil.org/`.  If we use url.parse to check the
> validity of the hostname, the test passes, but in the browser the
> user is redirected to the evil.org website.