Extract credential-stripping into a tested helper

Pull the parse-and-rebuild logic out of reportRepoEnabled into a pure cleanRemoteURLForReport helper and cover it with a table-driven test: embedded https tokens and user:password, query params, scp-style ssh users are all stripped, the .git suffix is normalized, and unparseable single-segment paths error. Guards assert no known secret survives in the cleaned URL.