Recorded redirect URLs retain userinfo and fragment credentials

I found that the fixture URL scrubber leaves username/password and fragment credentials in absolute redirect URLs. scrubCalls applies this helper to allowlisted response headers, so those values can remain in a recorded Location header written to a fixture. This reproduction uses invented credentials only.

Save this as repro-scrub-redirect.ts at the repository root and run deno run --allow-read --allow-env repro-scrub-redirect.ts with Deno 2:

import {scrubUrlCredentials} from './shared/testing/fixtures.ts';
for(const url of ['https://demo:example-password@api.test/file','https://api.test/file#access_token=example-token','https://demo:example-password@api.test/file?part=1&part=2#access_token=example-token']) console.log(scrubUrlCredentials(url));

Observed output retains demo:example-password@ and #access_token=example-token. The URL with two part parameters also loses one occurrence because URLSearchParams.set collapses repeated keys.

I expect the scrubbed absolute URL to contain no username/password, a redacted fragment, and one redacted value for each original query occurrence in its original order. The origin, path, and query names should remain available for fixture assertions.

The current helper returns early when there are no query keys and otherwise rewrites only query values. I propose removing userinfo, replacing the fragment with a placeholder, and rebuilding the query with one entry per existing key occurrence. Regression tests should cover queryless URLs and the scrubCalls path, including repeated keys and preservation of the input object.

This is scoped to the parsed components of absolute response-header URLs. Relative URL handling and path-embedded values are outside this change. I searched open and closed issues/PRs for scrubUrlCredentials, userinfo, fragments, and Location scrubbing and found no matching fix.