[actions] ensure connector URLs do not have auth info embedded in the URL

[pmuellr]

From a comment in PR 95365, it was noted that we should not allow customers to associate URLs that have embedded auth info in them, where we currently allow URLs.

For example, the url https://elastic:[email protected] contains an embedded userid / password of elastic / changeme. Allowing customers to enter this auth info means the URLs will end up containing sensitive information, and these fields are currently not encrypted like other "secrets" used in connectors.

Any connector that can handle (or requires) userid / password values already has these available as separate, encrypted fields, so there should be no loss of function when making this restriction.

I believe this affects the following connectors:

• jira
• resilient
• servicenow
• pagerduty
• teams
• webhook

It specifically does not affect slack, or is different, because the slack url contains an authentication token in the path, and is already stored encrypted. But I guess we should probably disallow using the embedded userid / password even in this case, just to standardize this restriction across the connectors.

[elasticmachine]

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

[pmuellr]

In addition to connectors, there are some config keys that are URLs (eg, proxy), and those should likewise be checked for auth info.