fix: use OR operator in includesCredentials per WHATWG URL Standard

[jackhax]

Summary

• Fix logical operator in includesCredentials() (lib/web/fetch/util.js): && → ||
• Add unit tests for includesCredentials() covering all credential combinations

Problem

The includesCredentials() function uses AND (&&) instead of OR (||), contradicting both:

1. Its own comment: "A URL includes credentials if its username or password is not the empty string."
2. WHATWG URL Standard §4.4: "A URL includes credentials if its username is not the empty string or its password is not the empty string."

This causes the Authorization header to be silently omitted during authentication retries for URLs with only a username (e.g., http://apitoken@host) or only a password (e.g., http://:secret@host).

Fix

 function includesCredentials (url) {
   // A URL includes credentials if its username or password is not the empty string.
-  return !!(url.username && url.password)
+  return !!(url.username || url.password)
 }

Test plan

• New test: URL with both username and password → true
• New test: URL with only username → true
• New test: URL with only password → true
• New test: URL with no credentials → false
• Existing fetch tests pass (no regressions)
• ESLint passes

Fixes: #4815

Ref: CWE-480: Use of Incorrect Operator

[mcollina]

lgtm

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.25%. Comparing base (b3326b5) to head (e7ff4db).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4816   +/-   ##
=======================================
  Coverage   93.25%   93.25%           
=======================================
  Files         109      109           
  Lines       34153    34153           
=======================================
  Hits        31848    31848           
  Misses       2305     2305           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.