Copilot AI linked an issue

that may be closed by this pull request

Closed

- Add stripUrlUserinfo() helper that removes user:password@ from all
  scheme:// URLs before domain filtering or redaction
- Call stripUrlUserinfo() at the start of sanitizeUrlDomains and
  sanitizeUrlProtocols so credentials are never retained for allowed
  domains or exposed in redaction output
- Remove all core.debug('Redacted URL (full): ...') calls that could
  disclose passwords, signed query params, or bearer tokens when Actions
  debug logging is enabled
- Update 'should log redacted domains' test to assert debug is NOT called
  with full URLs
- Add 6 regression tests: credentialed HTTPS/git URLs, log hygiene for
  credentials and signed query strings, username-only userinfo
Closes #50768
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title [WIP] Fix URL sanitization to strip userinfo and reduce logging Strip URL userinfo and stop logging complete rejected URLs

Copilot AI balanced review requested due to automatic review settings

…rinfo
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…test assertions
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>