Strip URL userinfo and stop logging complete rejected URLs

[pelikhan]

Problem

The HTTPS URL sanitizer regex does not model URL userinfo. A credentialed URL such as https://user:REDACTED@example.com/repo.git can be transformed while leaving the password/token suffix visible and later published in a safe output.

The sanitization code also emits complete rejected URLs through debug logging. This can disclose URL passwords, signed query parameters, SAS signatures, or bearer-like values when Actions debug logging is enabled.

Plan

1. Parse explicit HTTPS URLs structurally with URL or an equivalent robust parser.
2. Remove username/password userinfo before domain filtering or output rendering.
3. Preserve only safe structural metadata required for diagnostics.
4. Remove full rejected-URL debug logging; log only sanitized host/category information.
5. Add regression tests for credentialed git URLs, ports, IPv6, signed query strings, angle-bracket links, and malformed inputs.

Acceptance criteria

• Username and password/token components never survive sanitization.
• Full query strings and rejected URLs are never written to info/debug logs.
• Allowed-domain behavior remains compatible for URLs without credentials.
• Tests prove sentinel credentials are absent from both returned content and captured logs.

Relevant files

• actions/setup/js/sanitize_content_core.cjs
• actions/setup/js/sanitize_content_core_parser.test.cjs
• actions/setup/js/sanitize_content.test.cjs