fix(redact): mask passwords embedded in connection-string URLs

[MRX-72]

What & why

docksec/redact.py masks secrets before file content is sent to the LLM, but it missed passwords embedded in connection-string URLs (scheme://user:password@host). Keys such as DATABASE_URL, REDIS_URL, MONGO_URI, AMQP_URL, and SMTP_URL don't match the secret-key list, and the password inside the URL matches none of the value-shaped patterns, so it reached the provider in clear text. These URLs are one of the most common ways secrets show up in Dockerfiles and compose files.

Before:

redact_content("ENV DATABASE_URL=postgres://admin:s3cr3tPass@db:5432/app")
# -> ('ENV DATABASE_URL=postgres://admin:s3cr3tPass@db:5432/app', 0)   # leaked

After:

# -> ('ENV DATABASE_URL=postgres://admin:[REDACTED-BY-DOCKSEC]@db:5432/app', 1)

Approach

Adds a _URL_CREDENTIALS pattern that matches the userinfo of a URL and masks only the password, keeping the scheme, user, and host visible — consistent with the module's existing principle that "the key names stay visible, which is all the model needs to flag an exposed credential." It runs per line alongside the other value-shaped checks, so it applies regardless of the key name and covers the ENV, list-style, and quoted forms.

Handles redis://:pw@host (empty username) and leaves credential-free URLs (https://example.com, postgres://db:5432/app) untouched.

Tests

• test_redacts_password_in_url_credentials — five real URL forms; asserts each password is gone and the surrounding structure is preserved.
• test_leaves_url_without_password_alone — no false positives on URLs with no embedded credential.

Verification (matches CONTRIBUTING's local checks): pytest tests/ → 271 passed, 2 skipped; black --check, isort --check-only, and mypy docksec/redact.py clean.

Closes #168

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.13%. Comparing base (a2fe184) to head (718c56a).
⚠️ Report is 41 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #169      +/-   ##
==========================================
+ Coverage   78.95%   81.13%   +2.17%     
==========================================
  Files          26       32       +6     
  Lines        4158     5136     +978     
==========================================
+ Hits         3283     4167     +884     
- Misses        875      969      +94     

Flag	Coverage Δ
unittests	81.13% <100.00%> (+2.17%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[advaitpatel]

lgtm, thank you for your contributions