Startup log URL redaction: remaining edge cases (follow-up to #823) #826

Follow-up to #823 (redact credentials in startup URL logs).

#823 redacts userinfo and secret query params in the GitLab API URL lines logged at startup. A few rare input shapes are still not redacted and were left out of scope there:

1. URL in the middle of free text – a URL embedded inside a longer sentence is not detected/redacted by the text matcher.
2. Single-slash scheme – https:/user:pass@host (one slash) is not treated as having userinfo.
3. Secrets in the URL fragment – e.g. https://host/api/v4#private_token=...; only the query string is scrubbed, not the fragment.
4. Commas inside the password – when the URL list is split on commas, a password containing , gets cut and the tail can leak.

All of these require unusual configuration values, so impact is low, but the redaction helper should cover them for defense in depth.

Suggested fix: extend the shared redaction helper (introduced in #811/#823) to handle these cases, with unit tests for each.