fix(git): pick the forge from the remote host, not the whole URL

[BryanFRD]

Closes #799.

token_for_url decided the forge with url.contains("gitlab") against the whole remote URL, so the owner and repository name got a vote. https://github.com/acme/gitlab-migration-tool.git took the GitLab branch, looked for GITLAB_TOKEN, found none, and pushed with no credential at all while GITHUB_TOKEN sat unused.

The match now runs against the host only, via a host_of helper that handles the three remote shapes git accepts: https://, ssh://, and scp-style git@host:owner/repo. It strips a port and a user@ prefix.

Still a substring rather than an exact match, because a self-hosted GitLab is usually gitlab.acme.com and the previous behaviour accepted that too.

Verification

a_repository_name_does_not_pick_the_forge fails on the current main implementation and passes here:

test git::tests::a_repository_name_does_not_pick_the_forge ... FAILED
assertion `left == right` failed: https://github.com/acme/gitlab-migration-tool.git should use the GitHub token

a_gitlab_host_still_picks_gitlab covers the four GitLab remote shapes so the fix cannot regress into never selecting GitLab, and host_of_handles_the_remote_shapes_git_accepts pins the parser itself.

---

Bottom of a stack of four independent git/release fixes. The layer above is #1053.

[ferrfleet]

The direction is right: matching gitlab against the host instead of the whole URL fixes the repository-name false positive, and the tests cover the scp-like and non-default-port shapes.

One blocking issue in host_of: userinfo containing a password is parsed as the host, which regresses credentialed GitLab remotes. Inline suggestion attached.

[github-actions]

SonarQube — aucune nouvelle issue

_{Comparaison entre le projet bac à sable de cette PR et la branche par défaut : SonarQube Community n'analyse pas les PR, ce delta est calculé côté CI. Détail}

[BryanFRD]

Confirmed and fixed in 754f9e4. The trace is right: split(':') ran first, so oauth2:glpat-xxx@gitlab.com collapsed to oauth2 and is_gitlab went false. That is a regression against url.contains("gitlab"), and https://gitlab-ci-token:TOKEN@host/... is the shape GitLab CI writes by default, so it would have hit real pipelines.

host_of now splits on @ before the port. It also stops the authority at \, since WHATWG treats a backslash as a path separator for special schemes and https://github.com\@gitlab.com/... is host github.com.

Four cases added: two credentialed remotes, a credentialed remote with an explicit port, and the backslash shape. The gitlab and github lists in the two behaviour tests each gained a credentialed entry as well, so the classification is covered and not just the parser.

[ferrfleet]

The userinfo parsing issue from the previous review is fixed in 34bb979, with test coverage for the credentialed remote shapes. Nothing new in that commit.