net/http: Client.Do() panics when URL includes HTTP basic auth [1.13 backport]

[gopherbot]

@odeke-em requested issue #34878 to be considered for backport to the next 1.13 minor release.

Thank you for the report @bradleyjkemp!

This a new panic in Go1.13 that stems from the fact that invoking Header.Clone() when Header is nil returns a nil map as we implemented in CL https://go-review.googlesource.com/c/go/+/188022 to solve the inconsistency behavior of Clone as per #33141, but we didn't go through all the call sites to check that the map was nil before assignment.

The code posted up used to work in Go1.12 and before, now fails in Go1.13.
/cc @andybons @bradfitz @FiloSottile for awareness

@gopherbot please backport this issue to Go1.13.

[gopherbot]

Change https://golang.org/cl/201040 mentions this issue: [release-branch.go1.13] net/http: fix Transport panic with nil Request.Header

[gopherbot]

Closed by merging 2018d43 to release-branch.go1.13.