Prevent source credentials leaking to output

[alecthomas]

Summary

• Address the logging/output portion of DX-26 with a SourceURI wrapper whose String() representation redacts credentials and whose explicit Get() method returns the raw URI.
• Preserve the existing sources.Source interface while wrapping manifest and package source URIs at ingress, then carry SourceURI through URL rewriting, cache selectors, Git and HTTP source implementations, validation, status output, and command execution.
• Restrict raw access to boundaries that require it: parsing, cache-key and path derivation, HTTP request creation, and process execution.
• Redact through the final userinfo delimiter for accepted URLs containing an unescaped @.

Testing

• Added GitHubTokenIsRedactedFromOutput integration coverage for status, debug, validation, command output, and error paths.
• Added unit coverage for source URI formatting, URL validation, Git URL parsing, cache errors, Git arguments, and typed command execution/output redaction.

Linear: DX-26