Ok, so it’s very likely the wrong answer, but I removed the ampersand before the $handle parameter for FeedWordPressHTTPAuthenticator::set_auth_options() in feedwordpresshttpauthenticator.class.php and the error disappeared (and my feed imports still worked).
There is another potential way to resolve it (identified by a colleague) by editing line 57 of wp-includes/class-wp-http-requests-hooks.php, but editing core files is even more likely to be the wrong answer.
I’d therefore suggest, as a temporary fix, removing the ampersand on a test site and checking that nothing breaks. If it doesn’t, you might be safe putting the change live on production (I’m about to try that myself – wish me luck).