Do not accept save requests with credentials leaked in the origin URL

Currently, it is possible to submit a Save Code Now request with an origin URL containing HTTP basic authentication credentials.

As all submitted save requests are publicly browsable, we should forbid to submit such origin URLs to avoid leaking sensible data.

To do so, we must:

• invalidate Save Code Now form client-side when such an origin URL is submitted
• reject save request on the backend side when detecting such origin URL (in case request is submitted directly through our Web API)

---

Migrated from T4240 (view on Phabricator)