Sanitize credentials from snapshot repository URLs

[arska]

Summary

REST backend repository URLs can contain credentials in the userinfo component (e.g. rest:https://user:pass@host/path). These were stored verbatim in Snapshot CRs and visible via kubectl get snapshot, exposing credentials to anyone with read access to the namespace.

Before

$ kubectl get snapshot
NAME       DATE TAKEN             PATHS   REPOSITORY
ed134283   2025-07-08T01:00:05Z   /data   rest:https://backup:secret@backup.example.com/repo

After

$ kubectl get snapshot
NAME       DATE TAKEN             PATHS   REPOSITORY
ed134283   2025-07-08T01:00:05Z   /data   rest:https://redacted:redacted@backup.example.com/repo

Only REST backends are affected — S3/Azure/Swift/B2/GCS backends don't include credentials in the repository URL.

Fixes #1077

Checklist

• Commits are signed off
• PR contains the label area:operator
• I have not made any changes in the charts/ directory

Test plan

• Added unit tests for URL sanitization (all backend types)
• All existing snapshot tests pass

🤖 Generated with Claude Code

[tobru]

@Kidswiss Mind taking another look?

[bastjan]

Suggested change

	if idx := strings.Index(repo, ":"); idx > 0 {
	candidate := repo[:idx]
	// Check if it looks like a restic scheme (not a Windows drive letter or URL scheme)
	if candidate == "rest" || candidate == "s3" || candidate == "azure" || candidate == "swift" || candidate == "b2" || candidate == "gs" {
	prefix = repo[:idx+1]
	rest = repo[idx+1:]
	}
	}
	if candidate, after, found := strings.Cut(repo, ":"); found {
	// Check if it looks like a restic scheme (not a Windows drive letter or URL scheme)
	if candidate == "rest" || candidate == "s3" || candidate == "azure" || candidate == "swift" || candidate == "b2" || candidate == "gs" {
	prefix = candidate + ":"
	rest = after
	}
	}

Much easier to understand IMO.

[bastjan]

Suggested change

	},
	},
	"scheme only": {
	input: "s3:",
	expected: "s3:",
	},
	"windows drive letter": {
	input: "C:\\path\\to\\repo",
	expected: "C:\\path\\to\\repo",
	},
	"url scheme": {
	input: "http://example.com/repo",
	expected: "http://example.com/repo",
	},

We probably should test what was written in the comment.

[Kidswiss]

Please implement bastjan's suggestions.