archive: do not leak URL credentials in user visible messages

[mahaase]

Problem

The HTTP basic authentication credentials of the http archive backend are
part of the URL, as documented. All three places that turn that URL back into
a string for display use the raw netloc, which still carries the
user:password@ part:

	leaks via	visible
getArchiveName() (archive.py:877)	_namedErrorString() (archive.py:401)	always, no flag needed
_remoteName() (archive.py:902)	details of the DOWNLOAD/UPLOAD/MAP-SRC/CACHE-BID/CACHE-FPR/MAP-FPRNT status lines	with -v
getArchiveUri() (archive.py:966)	bob archive (cmds/archive.py:32)	always

The first one is the bad one. _namedErrorString() is used for every error
message, including the perfectly ordinary "artifact not found" that happens for
each package on a cache miss. So a plain bob build on a cold cache prints the
password once per package:

>> aarch64::linux/devel::sandbox/core::coreutils
   DOWNLOAD  work/core/coreutils/.../workspace .. https://user:s3cr3t@server.test/artifacts: artifact not found

These messages routinely end up in build logs, CI consoles and pasted-into-an-issue
snippets.

The optional name archive setting is not a workaround: _remoteName() and
getArchiveUri() never consult it.

Note this is a display-only issue. WebDav._getURL() already strips the
credentials before the URL goes on the wire; they are sent in the
Authorization header (webdav.py:47-55).

Fix

Factor the stripping that WebDav._getURL() already does into a
stripUserInfo() helper and use it in the three places above as well.

It takes and returns a parsed URL and preserves the result type, so both the
urlsplit() result used in webdav.py and the urlparse() result used in
archive.py work.

Drive-by: cut at the last @, not the first

The existing implementation used netloc.split('@')[1]. urlparse() delimits
the user info at the last @, so the two disagree when the password
contains an unencoded @:

>>> urlparse('https://u:p@ss@host:8443/x').netloc
'u:p@ss@host:8443'
>>> _.split('@')[1]        # before: bogus host, and part of the password survives
'ss'
>>> _.rsplit('@', 1)[1]    # after
'host:8443'

Percent encoding is documented as required, so this was latent rather than a
live bug, but there is no reason to get it wrong.

Tests

• TestHttpBasicAuthArchive.testNoCredentialsInMessages — asserts all three
  methods drop the password and the @, and still contain the host.
• TestStripUserInfo — no credentials (identity), removal, @ in the
  password, IPv6 literal, urlsplit() type preservation.

Reverting archive.py alone makes the first test fail on all three subtests;
test_archive + test_webdav are green with the fix (71 tests).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.25%. Comparing base (7b00892) to head (9ddcefe).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #706      +/-   ##
==========================================
+ Coverage   89.23%   89.25%   +0.02%     
==========================================
  Files          50       50              
  Lines       16450    16458       +8     
==========================================
+ Hits        14679    14690      +11     
+ Misses       1771     1768       -3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jkloetzke]

Please make this two commits for the fixes. One that prunes the credentials from the logs and one that splits the username/password and host name differently. These are two independent changes that should get their own commit.

The documentation commit can be dropped. Users of Bob probably don't care how HTTP basic auth works.

[jkloetzke]

AFAICT, this is an undocumented, private method. Just do it like _getURL() previously.