Keep credentials on same-host absolute redirects of the compact index

`uri + location` drops the userinfo when Location is an absolute URL, so
a private index redirecting to another path on the same host lost the
credentials and the follow-up request failed authentication. Bundler's
downloader already re-applies them; cross-host redirects still drop them.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: hsbt

lib/rubygems/compact_index_client/http_fetcher.rb

@@ -48,6 +48,9 @@ def fetch(uri, headers, redirects_remaining)
         if https?(uri) && !https?(redirect)
           raise Gem::RemoteFetcher::FetchError.new("redirecting to non-https resource: #{Gem::Uri.redact(redirect)}", uri)
         end
+        # An absolute Location on the same host drops the credentials that a
+        # relative one would have kept.
+        redirect.userinfo = uri.userinfo if redirect.host == uri.host && !redirect.userinfo
 
         fetch(redirect, headers, redirects_remaining - 1)
       when Gem::Net::HTTPRangeNotSatisfiable

test/rubygems/test_gem_compact_index_client_http_fetcher.rb

@@ -230,6 +230,17 @@ def test_call_keeps_credentials_on_an_accepted_redirect
     assert_equal "s3cr3t", remote.requests.last.first.password
   end
 
+  def test_call_keeps_credentials_on_an_absolute_same_host_redirect
+    remote = FakeRemoteFetcher.new(
+      "https://user:s3cr3t@index.example/versions" => FakeRedirect.new("https://index.example/v2/versions"),
+      "https://user:s3cr3t@index.example/v2/versions" => FakeResponse.new("data")
+    )
+    fetcher = Gem::CompactIndexClient::HTTPFetcher.new("https://user:s3cr3t@index.example", remote)
+
+    assert_equal "data", fetcher.call("versions").body
+    assert_equal "s3cr3t", remote.requests.last.first.password
+  end
+
   def test_call_drops_credentials_on_a_cross_host_redirect
     remote = FakeRemoteFetcher.new(
       "https://user:s3cr3t@index.example/versions" => FakeRedirect.new("https://mirror.example/versions"),