fix(appraisal): reject credentials embedded in RPC URLs

[karagozemin]

Problem

Appraisal API configuration accepts RPC URLs containing a username or password. Embedded credentials can leak through diagnostics, process inspection, or copied configuration.

Task

Reject HTTP or HTTPS RPC URLs whose parsed URL contains credentials. Preserve all existing URL and network behavior.

Acceptance criteria

• URLs with a username, password, or both are rejected with an AppraisalConfigError.
• Normal HTTP and HTTPS RPC URLs remain valid.
• The error does not echo credential contents.
• Appraisal configuration tests and typecheck pass.

Suggested implementation prompt

Add credential checks to appraisal RPC URL parsing, write focused tests for username and password URLs plus a valid control case, ensure errors do not reveal credentials, and keep the diff scoped.

[emrekayat]

can ı work on it?

[grantfox-oss]

🦊 GrantFox — @emrekayat has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #257)
2. Your PR will be reviewed by the Sub-Rosa-Issue maintainers

Good luck! Track your progress on GrantFox.