#61701 fix(core): reject URL credentials and ignore fragments in web permissions

Problem

webfetch and Code Mode fetch match permission rules against the parsed URL, so two URL parts let a request slip past a deny rule:

deny https://evil.com/*   request https://user@evil.com/x   → not matched, fetched
deny https://evil.com/x   request https://evil.com/x#a       → not matched, fetched

Change

Both tools, on the first request and on every redirect:

credentials in the URL → rejected (nothing legitimate needs them here)
fragment               → dropped before matching (it's never sent)

Verification

• bun test test/tool-webfetch.test.ts test/tool-execute.test.ts test/permission.test.ts test/codemode.test.ts test/codemode test/plugin in packages/core: 813 pass; the 2 new tests fail on dev
• bun run typecheck in packages/core: no errors