fix(build): identify the gallery by scheme and host, not string equality

Review pointed out that -ne is case-insensitive, so a source location
differing only in case would pass the check, and suggested -cne.

-cne would be wrong in the other direction. Host names are case-insensitive
by definition, so a strict comparison rejects
https://WWW.PowerShellGallery.com/api/v2 -- which is the real gallery. The
identifying part is the host, and a repository standing in for the gallery
would differ there, not in casing.

The source location is now parsed and its scheme and host compared, which
accepts any casing of the genuine host and rejects a different one.
Unparseable values are rejected too, where the previous string comparison
would have thrown on a null SourceLocation instead.

Verified:
  https://www.powershellgallery.com/api/v2   accepted
  https://WWW.PowerShellGallery.com/api/V2   accepted
  https://evil.example.com/api/v2            rejected
  not-a-uri                                  rejected

Unsigned at the author's request -- 1Password is unavailable this session.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G1CarQG8VibNFxw4cN53Zs

Author: tablackburn

build.ps1

@@ -108,10 +108,19 @@ if ($Bootstrap) {
         # is already registered against a different SourceLocation, every dependency in
         # build.depend.psd1 would be installed from it on the strength of the name alone.
         # Refuse rather than trust the name.
-        $expectedSourceLocation = 'https://www.powershellgallery.com/api/v2'
-        $actualSourceLocation = $psGallery.SourceLocation.TrimEnd('/')
-        if ($actualSourceLocation -ne $expectedSourceLocation.TrimEnd('/')) {
-            throw "The repository named 'PSGallery' points at [$actualSourceLocation], not [$expectedSourceLocation]. Refusing to install build dependencies from an unexpected source."
+        # Compare scheme and host rather than the whole string. What identifies the
+        # gallery is the host, and a plain -ne is case-insensitive while -cne would be
+        # wrong in the other direction: host names are case-insensitive by definition,
+        # so -cne would reject https://WWW.PowerShellGallery.com/api/v2, which is the
+        # real gallery. Parsing sidesteps both, and an attacker-controlled repository
+        # would differ by host, which is what this actually checks.
+        $expectedSource = [Uri]'https://www.powershellgallery.com/api/v2'
+        $actualSource = $psGallery.SourceLocation -as [Uri]
+        $sourceIsExpected = $null -ne $actualSource -and
+            $actualSource.Scheme -eq $expectedSource.Scheme -and
+            $actualSource.Host -eq $expectedSource.Host
+        if (-not $sourceIsExpected) {
+            throw "The repository named 'PSGallery' points at [$($psGallery.SourceLocation)], which is not $($expectedSource.Scheme)://$($expectedSource.Host). Refusing to install build dependencies from an unexpected source."
         }
 
         if ($psGallery.InstallationPolicy -ne 'Trusted') {