Require authentication when changing broker URL origin

[WeiQuan0605]

• A short explanation of the proposed change:
  Add a validation in ServiceBrokerUpdate#enqueue_update that rejects a URL-only PATCH request when the new URL has a different origin (scheme + host + port) from the current broker URL, unless authentication is also provided in the same request.

• An explanation of the use cases your change solves
  A SpaceDeveloper with access to a space-scoped broker could send PATCH /v3/service_brokers/:guid with only a new url pointing to an attacker-controlled server. Cloud Controller would preserve the old Basic credentials and send them to the new URL during the background catalog sync job, leaking the broker credentials to the attacker before any rollback could occur.

  This fix prevents the credential exfiltration by requiring authentication to be re-supplied whenever the broker URL origin changes.

• I have reviewed the contributing guide

• I have viewed, signed, and submitted the Contributor License Agreement

• I have made this pull request to the main branch

• I have run all the unit tests using bundle exec rake

• I have run CF Acceptance Tests

[jochenehret]

Tested on a bbl env, works.