sha256convert: redact credentials from source URL in output and tags

A source URL can embed credentials (https://user:token@host/...). Those were copied verbatim into the signed attestation tag message — which is permanent and gets pushed — as well as the "fetching ..." status line and the JSON/textual result.

Redact the whole userinfo component (not just the password: token auth often puts the secret in the username position, which url.URL.Redacted() leaves intact) before any of those surfaces. The fetch path keeps the original req.SourceURL, so authentication is unaffected.