Address NuGet discovery follow-up feedback

[brettfo]

What are you trying to accomplish?

Address the unresolved review feedback from #240 after restoring eager NuGet service-index discovery.

This change:

• Normalizes scheme-less service-index URLs to HTTPS before constructor-time discovery, while retaining their existing request-matching behavior.
• Rejects OIDC-authenticated discovery redirects to non-HTTPS destinations.
• Treats Azure DevOps hostnames case-insensitively when selecting Basic authentication for colonless PATs.
• Adds explicit coverage ensuring static authentication is stripped and remains stripped throughout an HTTPS-to-HTTP redirect chain.

Anything you want to highlight for special attention from reviewers?

Scheme-less URLs are normalized once when discovery jobs are registered, before source deduplication. Explicitly configured HTTP and HTTPS URLs remain unchanged and distinct.

Static discovery may continue following a downgrade redirect without credentials so it can still learn resource endpoints. OIDC discovery rejects the downgrade entirely rather than following it without the exchanged token.

How will you know you've accomplished your goal?

• Scheme-less feed configurations perform eager discovery through HTTPS and authenticate discovered resources.
• OIDC discovery never follows a redirect to a non-HTTPS URL.
• Static credentials are not sent during or after an HTTPS-to-HTTP redirect.
• Uppercase Azure DevOps and Visual Studio hostnames receive the same Basic-auth treatment as lowercase hostnames.
• go test ./... passes.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation satisfies the stated follow-up requirements with focused regression coverage.

Review tier: Balanced
Findings: None

What changed in this PR

Improves NuGet discovery URL handling and redirect security.

Changes:

• Normalizes scheme-less discovery URLs to HTTPS.
• Rejects insecure OIDC redirects and handles Azure hostnames case-insensitively.
• Adds regression coverage for normalization and redirect authentication stripping.

File	Description
internal/​handlers/​nuget_feed.go	Implements URL normalization and authentication safeguards.
internal/​handlers/​nuget_feed_test.go	Covers new discovery, redirect, and hostname behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.