Redact credentials when displaying URLs (#13333)

This PR redacts credentials in displayed URLs. 

It mostly relies on a `redacted_url` function (and where possible
`IndexUrl::redacted`). This is a quick way to prevent leaked credentials
but it's prone to programmer error when adding new trace statements. A
better follow-on would use a `RedactedUrl` type with the appropriate
`Display` implementation. This would allow us to still extract
credentials from the URL while displaying it securely. On the plus side,
the sites where the `redacted_url` function are used serve as easy
signposts for where to use the new type in a future PR.

Closes #1714.

crates/uv-client/src/error.rs

@@ -7,6 +7,7 @@ use url::Url;
 
 use uv_distribution_filename::{WheelFilename, WheelFilenameError};
 use uv_normalize::PackageName;
+use uv_redacted::redacted_url;
 
 use crate::middleware::OfflineError;
 use crate::{html, FlatIndexError};
@@ -197,10 +198,10 @@ pub enum ErrorKind {
     #[error("Failed to fetch: `{0}`")]
     WrappedReqwestError(Url, #[source] WrappedReqwestError),
 
-    #[error("Received some unexpected JSON from {url}")]
+    #[error("Received some unexpected JSON from {}", redacted_url(url))]
     BadJson { source: serde_json::Error, url: Url },
 
-    #[error("Received some unexpected HTML from {url}")]
+    #[error("Received some unexpected HTML from {}", redacted_url(url))]
     BadHtml { source: html::Error, url: Url },
 
     #[error("Failed to read zip with range requests: `{0}`")]

crates/uv-client/src/flat_index.rs

@@ -10,6 +10,7 @@ use uv_cache_key::cache_digest;
 use uv_distribution_filename::DistFilename;
 use uv_distribution_types::{File, FileLocation, IndexUrl, UrlString};
 use uv_pypi_types::HashDigests;
+use uv_redacted::redacted_url;
 use uv_small_str::SmallString;
 
 use crate::cached_client::{CacheControl, CachedClientError};
@@ -207,7 +208,7 @@ impl<'a> FlatIndexClient<'a> {
                             Ok(file) => Some(file),
                             Err(err) => {
                                 // Ignore files with unparsable version specifiers.
-                                warn!("Skipping file in {url}: {err}");
+                                warn!("Skipping file in {}: {err}", redacted_url(&url));
                                 None
                             }
                         }

crates/uv-client/src/registry_client.rs

@@ -31,6 +31,7 @@ use uv_pep440::Version;
 use uv_pep508::MarkerEnvironment;
 use uv_platform_tags::Platform;
 use uv_pypi_types::{ResolutionMetadata, SimpleJson};
+use uv_redacted::redacted_url;
 use uv_small_str::SmallString;
 use uv_torch::TorchStrategy;
 
@@ -484,7 +485,10 @@ impl RegistryClient {
             // ref https://github.com/servo/rust-url/issues/333
             .push("");
 
-        trace!("Fetching metadata for {package_name} from {url}");
+        trace!(
+            "Fetching metadata for {package_name} from {}",
+            redacted_url(&url)
+        );
 
         let cache_entry = self.cache.entry(
             CacheBucket::Simple,