archive: do not leak URL credentials in user visible messages

[mahaase]

Problem

The HTTP basic authentication credentials of the http archive backend are
part of the URL, as documented. All three places that turn that URL back into
a string for display use the raw netloc, which still carries the
user:password@ part:

	leaks via	visible
getArchiveName() (archive.py:877)	_namedErrorString() (archive.py:401)	always, no flag needed
_remoteName() (archive.py:902)	details of the DOWNLOAD/UPLOAD/MAP-SRC/CACHE-BID/CACHE-FPR/MAP-FPRNT status lines	with -v
getArchiveUri() (archive.py:966)	bob archive (cmds/archive.py:32)	always

The first one is the bad one. _namedErrorString() is used for every error
message, including the perfectly ordinary "artifact not found" that happens for
each package on a cache miss. So a plain bob build on a cold cache prints the
password once per package:

>> aarch64::linux/devel::sandbox/core::coreutils
   DOWNLOAD  work/core/coreutils/.../workspace .. https://user:s3cr3t@server.test/artifacts: artifact not found

These messages routinely end up in build logs, CI consoles and pasted-into-an-issue
snippets.

The optional name archive setting is not a workaround: _remoteName() and
getArchiveUri() never consult it.

Note this is a display-only issue. WebDav._getURL() already strips the
credentials before the URL goes on the wire; they are sent in the
Authorization header (webdav.py:47-55).

Fix

Factor the stripping that WebDav._getURL() already does into a
stripUserInfo() helper and use it in the three places above as well.

It takes and returns a parsed URL and preserves the result type, so both the
urlsplit() result used in webdav.py and the urlparse() result used in
archive.py work.

Drive-by: cut at the last @, not the first

The existing implementation used netloc.split('@')[1]. urlparse() delimits
the user info at the last @, so the two disagree when the password
contains an unencoded @:

>>> urlparse('https://u:p@ss@host:8443/x').netloc
'u:p@ss@host:8443'
>>> _.split('@')[1]        # before: bogus host, and part of the password survives
'ss'
>>> _.rsplit('@', 1)[1]    # after
'host:8443'

Percent encoding is documented as required, so this was latent rather than a
live bug, but there is no reason to get it wrong.

Tests

• TestHttpBasicAuthArchive.testNoCredentialsInMessages — asserts all three
  methods drop the password and the @, and still contain the host.
• TestStripUserInfo — no credentials (identity), removal, @ in the
  password, IPv6 literal, urlsplit() type preservation.

Reverting archive.py alone makes the first test fail on all three subtests;
test_archive + test_webdav are green with the fix (71 tests).

Docs

One sentence in the basic auth section of configuration.rst stating that the
credentials are stripped from displayed URLs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.25%. Comparing base (7b00892) to head (7bc796d).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #706      +/-   ##
==========================================
+ Coverage   89.23%   89.25%   +0.01%     
==========================================
  Files          50       50              
  Lines       16450    16459       +9     
==========================================
+ Hits        14679    14690      +11     
+ Misses       1771     1769       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.