test: validate provider URLs structurally

[stefan-jansen]

Summary

• replace substring URL assertions with parsed scheme, exact hostname, and path checks
• preserve provider contracts while resolving three CodeQL incomplete-URL-sanitization findings
• refresh the pinned ecosystem workflow so the approved Python 3.15 wait covers development versions below 0.2

Affected version

ml4t-data 0.1.8 and current main.

Verification

• 121 focused provider tests passed
• Ruff check and format passed
• pre-commit hooks passed
• CodeQL passed
• all 25 applicable remote checks passed; the Python 3.15 prerelease matrix was intentionally skipped in favor of its approved exception check

Closes #67

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.