HTTP Basic Proxy Authentication with an Empty Password
Recognize the empty-password separator when an upstream proxy uses an API key as its Basic authentication username.
In login=API_KEY:, the final colon can mean “the password is empty.” HTTP Basic credentials consist of username, colon and password. When a service specifies an API key as the username with an empty password, the pair is API_KEY:; the colon is not part of the account's key.
Keep the service contract with this interpretation. Another service may put the token in the password field or use another authentication mechanism. A trailing colon alone cannot establish what its server expects.
Squid's cache_peer login syntax also differs from a proxy URL's user-information syntax. Reserved characters may need URL encoding in one interface and different quoting in the other; preserve the rules of the actual setting.
TLS to the parent is a separate choice. Changing that transport does not change the Basic credential pair or decide whether the destination website uses HTTPS.