Missing explicit client timeouts and resource bounds

The file is a standalone demo (`main`) with a hardcoded local endpoint and no direct external input to the program itself. Therefore, there are no obvious memory-safety zero-day issues in this Go code. The main risks are hardening issues: suppressed error handling, hardcoded credentials, lack of client timeouts/bounds, and echoing raw network-controlled data to stdout.

```json
[
  {
    "severity": "low",
    "title": "Ignored URI parse error",
    "function": "main",
    "description": "url.Parse(nil, []byte(\"http://localhost:8080/\")) has its error suppressed with //nolint:errcheck. If parsing were to fail due to a code change, library behavior change, or non-literal input, url could be zero-valued or retain stale pooled state and would still be copied into the request. With the current hardcoded literal this is not exploitable, but it is unsafe error handling."
  },
  {
    "severity": "low",
    "title": "Hardcoded credentials sent to local endpoint",
    "function": "main",
    "description": "The URI is given hardcoded username and password values, and the client connects to localhost:8080. If any local process can bind or observe traffic on localhost:8080, it can capture these credentials. This is an information-exposure risk, though not a direct external network-input bug."
  },
  {
    "severity": "low",
    "title": "Missing explicit client timeouts and resource bounds",
    "function": "main",
    "description": "HostClient is created with only Addr set. A hostile or unresponsive local server can delay or stall the request, causing Do() to block indefinitely. Configuring dial timeouts, MaxConnDuration, MaxResponseBodySize, and MaxHeaderBytes would reduce availability and resource-exhaustion impact."
  },
  {
    "severity": "low",
    "title": "Raw response body printed to stdout",
    "function": "main",
    "description": "fmt.Printf(\"Response: %s\\n\", resp.Body()) writes arbitrary network-controlled bytes to stdout. If stdout is used for logging, parsing, or shared with other components, this can leak sensitive response data or enable log-injection-style issues. This is low severity because the program is a demo and stdout is not a high-value trust boundary by default."
  }
]
```