Strip credentials from normalized Git remote URLs

[arseniy-pplx]

Summary

Git remote URLs can embed authentication material in their userinfo (https://user:token@host/...) — most commonly via CI checkout URLs (e.g. GitLab's https://gitlab-ci-token:<token>@gitlab.com/...) or a caller-supplied --git-remote-url. Previously _normalize_git_url only rewrote SSH/SCP forms and stripped the .git suffix, so credentials in an http(s) URL flowed unchanged into published component annotations, CLI output, logs, transparency reasons, and generated browse links. This change makes credential removal a hard guarantee of URL normalization.

• _normalize_git_url (utils.py) is now the canonical sanitizer: it parses the URL, rebuilds the netloc from host + port only (dropping all user[:password]@ userinfo), converts ssh:// to https://, drops userinfo from SCP-style remotes, strips the .git suffix, and redacts known sensitive query parameters (access_token, private_token, password, sig, etc.). It is idempotent.
• Handles percent-encoded userinfo, username-only, password-only/empty-username, IPv6 literals, explicit ports, ssh://, SCP-style user@host:path, file://, bare local paths, and Windows drive paths without corrupting valid input.
• ComponentPublisher sanitizes the resolved git_remote_url at construction, so a caller-supplied --git-remote-url (which bypasses get_git_info's normalization) can never persist credentials into annotations.
• component_inspector sanitizes git_remote_url before emitting it in transparency reasons and before building browse links, as defense-in-depth for annotations that arrive from the server.

Context

Scheme, host, port, path, and fragment are preserved; only credential material is removed. Actual clone/fetch authentication is unaffected — sanitization applies to the persisted or displayed value, not to any network operation.

Testing

• uv run pytest tests/test_component_inspector.py tests/test_component_publisher.py tests/test_utils.py
• added parametrized tests covering credential stripping (percent-encoded, token-only, password-only, IPv6, ports, GitLab CI token URLs), explicit no-secret / no-@ assertions, sensitive query-param redaction, and preservation/idempotency for credential-free URLs and local paths
• uvx ruff check on the touched files
• uv lock --check; uv build --sdist; CLI import/--help smoke check
• git diff --check