Restrict cleartext credential URLs to loopback hostnames

[sylvesterkaczmarek]

Summary

Restrict the credential subsystem's cleartext-HTTP exception to explicit loopback hostnames instead of textual URL prefixes.

_require_https() protects OAuth/federation token-exchange endpoints, whose request bodies can contain an assertion JWT or a long-lived refresh token. It currently allows local test endpoints with prefix checks such as url.startswith("http://localhost") and url.startswith("http://127.0.0.1").

Those checks also accept non-local lookalike hosts including http://localhost.evil.example and http://127.0.0.1.evil.example. A credential configuration using one of those hosts can therefore pass the HTTPS guard and send secret token-exchange material over cleartext HTTP to a remote endpoint.

Fix

Parse the URL and validate its scheme and hostname separately.

• HTTPS remains accepted normally.
• Cleartext HTTP is accepted only when the parsed hostname is exactly localhost, 127.0.0.1, or ::1.
• A trailing DNS dot on localhost. remains supported for local testing.
• Lookalike domains, userinfo tricks, private-network addresses, and ordinary remote HTTP endpoints are rejected.

This preserves the existing localhost testing exception without allowing prefix-based hostname confusion.

Regression coverage

Adds focused tests covering valid HTTPS and loopback endpoints plus deceptive/non-loopback cleartext URLs, including:

• localhost.evil.example
• localhost-example.com
• 127.0.0.1.evil.example
• localhost@evil.example
• a private-network address
• a normal remote HTTP host

The production change is confined to the hand-maintained credential URL validation helper.