fix(security): refuse an extra slash after https:// in typed base URLs - #9913

Summary

• refuseUnsafeUrlForm now refuses a slash or backslash right after http(s)://. The URL parser skips those, so https:///user:pass@host slipped past refuseUnsafeTypedUrl's authority check and a caller's normalizer silently dropped the credentials
• Both normalizeHttpBaseUrl and refuseUnsafeTypedUrl inherit it (GitLab, ServiceNow, Infisical, EmailBison, Jupyter, Logfire and the other typed-host validators)
• A bare host:port such as ftp:123 is unchanged: every caller prefixes https://, so it stays a host and port

Type of Change

• Bug fix

Testing

• input-validation.test.ts: two new cases fail on the old guard and pass now (141 passing)
• Caller suites: token-service-accounts validators, Infisical, EmailBison, Jupyter (264 passing)
• biome on the changed files; CI runs type-check and audits

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)