clawhdf5-remote, h5rs: URLs' credentials are never shown

Every RemoteError message and HttpStorage's Debug output held the URL as
given, with any user:password@ and the query string — for a presigned
S3/GCS/Azure URL, its signature or token. An application logging the
error leaked the credential.

- New clawhdf5_remote::redact_url: no userinfo, no fragment, query values
  replaced by REDACTED (plain key names kept).
- HttpStorage formats every message with the redacted URL, and scrubs the
  URL's secret parts from errors of the HTTP client (whose texts can echo
  the URI); Debug shows the redacted URL. storage_for_url's and the object
  store URL errors are redacted too. HttpStorage::url() still returns the
  URL as given, documented as not for logging.
- h5rs prints FILE arguments that are URLs redacted: in errors and in
  dump/stat/check/diff output.
- The test server can force a status and send a wrong Content-Range.

Tests: 404, 403 (at open and on a read), wrong Content-Range (at open and
on a read), no range support, encoded body, ETag change, timeout,
connection closed and bad scheme errors, Display and Debug, contain none
of the secrets; h5rs likewise for every subcommand.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

crates/clawhdf5-remote/src/object.rs

@@ -239,13 +239,14 @@ impl Storage for ObjectStoreStorage {
 /// `GOOGLE_*`, `AZURE_*`).
 #[cfg(any(feature = "s3", feature = "gcs", feature = "azure"))]
 pub(crate) fn store_for_url(url: &str) -> Result<(Arc<dyn ObjectStore>, Path), RemoteError> {
+    let redactor = crate::error::Redactor::new(url);
     let parsed = object_store::path::Path::parse(
         url.split_once("://")
             .and_then(|(_, rest)| rest.split_once('/'))
             .map(|(_, key)| key)
             .unwrap_or(""),
     )
-    .map_err(|e| RemoteError::InvalidUrl(format!("{url}: {e}")))?;
+    .map_err(|e| RemoteError::InvalidUrl(format!("{}: {e}", crate::redact_url(url))))?;
     let scheme = url.split_once("://").map(|(s, _)| s.to_ascii_lowercase());
     let store: Arc<dyn ObjectStore> = match scheme.as_deref() {
         #[cfg(feature = "s3")]
@@ -253,23 +254,23 @@ pub(crate) fn store_for_url(url: &str) -> Result<(Arc<dyn ObjectStore>, Path), R
             object_store::aws::AmazonS3Builder::from_env()
                 .with_url(url)
                 .build()
-                .map_err(os_error)?,
+                .map_err(|e| os_error(e).scrubbed(&redactor))?,
         ),
         #[cfg(feature = "gcs")]
         Some("gs") => Arc::new(
             object_store::gcp::GoogleCloudStorageBuilder::from_env()
                 .with_url(url)
                 .build()
-                .map_err(os_error)?,
+                .map_err(|e| os_error(e).scrubbed(&redactor))?,
         ),
         #[cfg(feature = "azure")]
         Some("az" | "azure" | "abfs" | "abfss" | "adl") => Arc::new(
             object_store::azure::MicrosoftAzureBuilder::from_env()
                 .with_url(url)
                 .build()
-                .map_err(os_error)?,
+                .map_err(|e| os_error(e).scrubbed(&redactor))?,
         ),
-        _ => return Err(RemoteError::UnsupportedScheme(url.to_string())),
+        _ => return Err(RemoteError::UnsupportedScheme(crate::redact_url(url))),
     };
     Ok((store, parsed))
 }