allowLocalInfile=false does not block LOAD DATA LOCAL INFILE against a malicious server

When allowLocalInfile=false, the driver omits the CLIENT_LOCAL_FILES capability so a compliant server rejects LOAD DATA LOCAL INFILE.

However, the local-infile request handler (ClientMessage#readPacket, the 0xfb branch) never re-checks allowLocalInfile. A malicious or MitM server can ignore the missing capability and send a 0xfb local-infile request anyway, the driver processes it and, when the client's own SQL is a genuine LOAD ... LOCAL INFILE '<file>', streams that file to the server, despite allowLocalInfile=false.

thanks tharavel for the report