Reject invalid UTF-8 URL credentials

[zaniebot]

Summary

• make URL credential extraction fallible
• reject percent-decoded usernames and passwords that are not valid UTF-8
• propagate credential decoding errors through index, Git, project, publish, and HTTP client paths
• add unit and end-to-end regression coverage

Why

Lossy decoding replaced malformed bytes with U+FFFD, silently changing the credential sent on the wire and collapsing distinct inputs. URL parsing remains permissive; the error is raised only when converting URL userinfo into uv's string credential model.

Follow-up to astral-sh#19800 (comment).

Validation

• cargo test -p uv-auth --lib
• cargo test -p uv --test pip_install install_package_basic_auth_invalid_utf8
• cargo check -p uv-auth -p uv-client -p uv-distribution-types -p uv-distribution -p uv-git -p uv-publish -p uv
• cargo +stable fmt --all -- --check

Repository-wide clippy under the local toolchain is currently blocked by warnings in unchanged files; no clippy suppressions or unrelated fixes are included here.