permitLocalInfile=false does not block LOAD DATA LOCAL INFILE against a malicious server

When permitLocalInfile=false, the driver omits the CLIENT_LOCAL_FILES capability, so a compliant server rejects LOAD DATA LOCAL INFILE.

However, the local-infile request handler never re-checks permitLocalInfile. A malicious or MitM server can ignore the missing capability and send a 0xfb local-infile request anyway; the driver processes it and, when the client's own SQL is a genuine LOAD ... LOCAL INFILE '<file>', streams that file to the server, despite permitLocalInfile=false.