Merge commit from fork

* Stop logging credentials from configured URLs and the IPinfo token (GHSA-hjr3-rx4c-24cv)

With --debug, the Splunk HEC, Elasticsearch and OpenSearch client-init
lines and opensearch.set_hosts() logged configured URLs verbatim, so
userinfo passwords reached the console and log_file (CWE-532).

Triage found more paths of the same class:
- the httpx "HTTP Request:" line, forwarded at --verbose/--debug,
  contains the full URL (str(httpx.URL) keeps userinfo and query), so
  webhook and HEC URL credentials and the IPinfo ?token= were logged
  on every request;
- the PSL overrides, IP database and reverse DNS map downloaders logged
  their URL at DEBUG and str(HTTPStatusError), which embeds the full
  URL, at WARNING;
- libpq echoes the DSN or a password fragment for some malformed
  PostgreSQL connection strings, logged as an output-client error.

Add redact_url_credentials() (string methods only; urlsplit misparses
scheme-less "user:pw@host:port") and use it at each log site; add a
filter on the httpx logger that masks userinfo and the token query
value; build download-failure warnings from the status code and the
redacted request URL instead of the exception text; replace psycopg
ProgrammingError detail from a connection_string with a fixed message.
Docs now recommend separate user/password settings over URL
credentials.

Reported by helixnebulatech.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Mask credentials in the Loki URL in the log and LokiError text

The Loki output (#926) landed on master after this fix was written. Its
url keeps userinfo (copy_with(path=...) preserves it), and the --debug
"Initializing Loki client" line and both LokiError messages, which the
CLI logs on a failed push, included it as-is: the same CWE-532 path as
the Splunk HEC line. Mask it with redact_url_credentials() at all three
sites.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Withhold InvalidURL details, mask malformed URLs, and cover httpx2 and DoH nameservers

Follow-up for GHSA-hjr3-rx4c-24cv (CWE-532):

- httpx.InvalidURL quotes the component it rejected, so a password with
  an unencoded "/", "?" or "#" (RFC 3986 3.2: the authority ends there)
  leaked as "Invalid port: 'p4ssw0rd'", and its chained ValueError repeats
  it. Loki, Splunk HEC, the webhook and the three download loaders now
  report a fixed "details withheld" message raised from None.
  InvalidURL is not an httpx.HTTPError, so a malformed psl_overrides_url
  crashed startup; the loaders now treat it as a download failure.
- redact_url_credentials() masks through the last "@" when the authority
  has no "@" but one follows it, so the --debug lines no longer print
  such passwords; the userinfo lookup is shared with the new nameserver
  masking.
- dnspython 2.9 DoH logs its request line on the httpx2 logger, which was
  forwarded but not filtered; the filter now covers httpx2 and
  httpx2.URL.
- [general] nameservers / --nameservers credentials are masked in the
  DNS pre-flight error, reverse DNS debug errors and per-report errors,
  and unusable https:// / tls:// ports are rejected before any query.
- Docs recommend token/username settings for [loki] and [splunk_hec];
  AGENTS.md gains rules for keeping credentials out of logs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Sean Whalen <seanthegeek@users.noreply.github.com>

tests/test_opensearch.py

@@ -241,6 +241,30 @@ class TestSetHosts(unittest.TestCase):
         kwargs = mock_conn.call_args.kwargs
         self.assertEqual(kwargs["hosts"], ["es1:9200", "es2:9200"])
 
+    def test_debug_log_masks_credentials_but_connects_with_them(self):
+        """GHSA-hjr3-rx4c-24cv: the "Connecting to OpenSearch" debug line
+        must not carry the URL password, while the client still gets the
+        real URL."""
+        url = "https://admin:s3cretPW@es.example:9200"
+        with patch("parsedmarc.opensearch.connections.create_connection") as mock_conn:
+            with self.assertLogs("parsedmarc.log", level="DEBUG") as logs:
+                set_hosts(url)
+        output = "\n".join(logs.output)
+        self.assertNotIn("s3cretPW", output)
+        self.assertIn("https://admin:***@es.example:9200", output)
+        self.assertEqual(mock_conn.call_args.kwargs["hosts"], [url])
+
+    def test_debug_log_masks_schemeless_host_list(self):
+        hosts = ["admin:s3cretPW@es1:9200", "es2:9200"]
+        with patch("parsedmarc.opensearch.connections.create_connection") as mock_conn:
+            with self.assertLogs("parsedmarc.log", level="DEBUG") as logs:
+                set_hosts(hosts)
+        output = "\n".join(logs.output)
+        self.assertNotIn("s3cretPW", output)
+        self.assertIn("admin:***@es1:9200", output)
+        self.assertIn("es2:9200", output)
+        self.assertEqual(mock_conn.call_args.kwargs["hosts"], hosts)
+
     def test_timeout_default_60s(self):
         with patch("parsedmarc.opensearch.connections.create_connection") as mock_conn:
             set_hosts("es:9200")