Strip authentication from editable VCS URLs in pip freeze

[moodyastra]

What does this PR do?

Fixes #11410.

Editable VCS installs derive their frozen requirement from the clone's remote URL. This change strips concrete authentication information before pip freeze emits that requirement, while preserving literal PEP 610 environment-variable references and the git@ user for SSH remotes.

It adds an end-to-end regression test and focused coverage for safe and unsafe user-info forms.

PR Checklist:

• I agree to follow the PSF Code of Conduct.
• I have read and have followed the CONTRIBUTING.md file.
• I have added a news file fragment.
• I have read and followed the AI_POLICY.md file, and I take full ownership and responsibility for every line.

Assisted-by: OpenAI Codex

Tests

• pytest tests/unit/test_operations_freeze.py: 13 passed
• pytest tests/functional/test_freeze.py: 25 passed, 6 skipped, 1 xfailed
• Black, Ruff, codespell, and repository policy hooks passed
• Mypy passed for all three changed Python files under its Linux target platform

[sepehr-rs]

Hi @moodyastra, thanks a lot for your contribution! The implementation looks good to me, and the tests cover it nicely.

One small question though: in _strip_auth_from_editable_requirement, the SSH git user exception checks user_pass == "git" directly against the netloc, so %67%69%74@example.com gets stripped instead of being preserved. The test confirms this is the current behavior. Was that intentional? If so, a brief comment in the code explaining why would help future readers.

[moodyastra]

Thanks for catching that, and for the kind review! Yes, that was intentional. I kept the exception deliberately narrow and consistent with the existing DirectUrl redaction behavior: only the literal git username over SSH is treated as known non-secret. I intentionally don't URL-decode userinfo before the allowlist check, so percent-encoded variants remain on the conservative credential-stripping path rather than broadening the exception.

Great point about making that intent clear — I added a brief comment in de6b66f. Thanks again!