fix: measure size-lookup credentials against their real destination

Adversarial review of the GitHub size preflight found the credential policy split between gitproto.EndpointAuth and bootstrap's sourceCredentials, neither of which looked at where the request goes.

HTTPConn.CredentialsFor(dest) replaces both. Each credential is measured from the URL it is bound to (EndpointURL for explicit and URL userinfo, the lookup URL for helper credentials), dest must be same-site with it, and with TLS verification off nothing crosses to another host. So:

• helper credentials looked up for a redirect host no longer reach a sibling of that host;
• credentials are not sent to the API with TLS verification off;
• a URL username without a password is not sent (it may be an account name, which the API would only refuse);
• the configured API base no longer receives credentials unless it is on the source's site.

Also:

• log "authenticated" from the request that produced the answer, so a redirect that stripped the header reads false;
• strip C1 controls and bidi formatting from GitHub's message;
• notice says the bootstrap "starts with" a single pack, and a failed lookup is no longer printed twice under -v;
• one record name for the verbose log and PushLogger;
• githubSizeLookup keeps the refused attempt as a nested answer;
• the redirect test asserts the redirect target was reached;
• docs: a public repo reached only through a credential helper is still looked up anonymously.