Redact credentials in dependency-group parse errors

[zaniebot]

The outer dependency-group parse error prints the original requirement directly, so URL userinfo can remain visible even when the underlying PEP 508 error is redacted. Render that entry with the same userinfo-masking policy while retaining the original requirement and typed source for diagnostics.

[codspeed-hq]

Merging this PR will not alter performance

✅ 25 untouched benchmarks

---

_{Comparing zb/future-20260912-parser-diagnostics-02 (fb09d7f) with zb/future-20260912-parser-diagnostics-01 (525948b)}