fix: preserve credentials for sharded repodata URLs

[jdr45]

Description

Fix sharded repodata downloads when a channel URL contains credentials.

The sharded repodata path was deriving shard URLs from repodata_url().str() with the default credential policy, which masks embedded credentials as *****. Those masked credentials can then be preserved when constructing shard URLs, causing authenticated mirrors/proxies to reject shard requests and making libmamba fall back to flat repodata.json.

This changes the sharded repodata URL construction to preserve credentials explicitly when deriving the current repodata URL and subdir repodata URLs.

Type of Change

• Bugfix
• Feature / enhancement
• CI / Documentation
• Maintenance

Checklist

• My code follows the general style and conventions of the codebase, ensuring consistency
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings
• I have run pre-commit run --all locally in the source folder and confirmed that there are no linter errors.
• I have added tests that prove my fix is effective or that my feature works
• New and existing tests pass locally with my changes