Reject document URLs with credentials #1294

Both built-in document loaders, getDocumentLoader() in @fedify/vocab-runtime and getAuthenticatedDocumentLoader() in @fedify/fedify, accept URLs that contain a username or password, such as https://user:pass@example.com/collection, and pass them to the runtime's fetch(). What happens next depends on the runtime: Node.js throws a TypeError while constructing the Request, while Deno and Bun send the request. The same applies to redirect targets and to alternate documents found through a Link header or an HTML <link rel="alternate">.

Since the Node.js failure is a plain TypeError rather than a UrlError, callers that treat other loader errors as transient can retry a sender-supplied URL that will never load instead of rejecting it permanently. This came up in review of #1291, whose inbox handling makes that distinction.

At 2.4.3 (2.4-maintenance), this reproduces with:

import { getDocumentLoader } from "@fedify/vocab-runtime";

await getDocumentLoader({ allowPrivateAddress: true })(
  "https://user:pass@example.com/collection",
);

Expected: reject the URL with UrlError before fetching, on every runtime and regardless of allowPrivateAddress.

Actual: on Deno 2.9.7 and Bun 1.2.22 the request is sent; on Node.js 22.23.3 it fails with TypeError: Request cannot be constructed from a URL that includes credentials. Unlike #1292, allowPrivateAddress: false does not help, because validatePublicUrl() checks the scheme and host but not the userinfo. Every loader configuration on 2.0-maintenance through 2.4-maintenance and main is affected.

A fix for 2.5 makes both loaders throw UrlError for credential-bearing URLs, including redirect and alternate targets. This issue also tracks the backport to 2.0-maintenance, the oldest affected maintenance branch, with regression tests for direct, redirected, and alternate URLs under both allowPrivateAddress settings.