fix: Reject an upload URL whose host differs from the configured upload host

[sushant-me]

UploadReleaseAssetFromRelease takes release.UploadURL from the server's response, and NewUploadRequest lets an absolute URL replace the client's configured upload host entirely (url.URL.Parse discards the receiver for an absolute reference). A response naming a different host therefore received the artifact and the caller's Authorization header, while the caller's own WithURLs/WithEnterpriseURLs upload configuration was silently ignored.

release := &RepositoryRelease{UploadURL: "https://example.invalid/upload{?name,label}"}
// previously: POST https://example.invalid/upload?name=n.txt  (with the bearer token)
// now:        error: upload URL host "example.invalid" does not match the
//             client's configured upload host "uploads.github.com"

The check runs only for absolute values; relative URLs — what GitHub actually returns, and the case the existing tests cover — are untouched. It compares against c.uploadURL rather than c.baseURL, because uploads.github.com and api.github.com differ by design.

This does not overlap with #4363/#4364/#4366: those scope the token for a foreign origin but would still POST the artifact body there. Rejecting the request keeps both on the configured host.

TestRepositoriesService_UploadReleaseAssetFromRelease_ForeignHostIsRejected fails on master (expected an error for an upload URL naming a foreign host, got nil) and passes with this change. go test ./github/ and script/lint.sh both pass.

Assisted contribution: an AI tool drafted the change, the test, and this description. I reviewed the rendered diff, ran the full github package test suite and script/lint.sh, and verified the new test fails without the fix.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[sushant-me]

@googlebot I signed it!

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.57%. Comparing base (44d6f18) to head (0f8fb80).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #4556   +/-   ##
=======================================
  Coverage   98.57%   98.57%           
=======================================
  Files         197      197           
  Lines       18291    18299    +8     
=======================================
+ Hits        18030    18038    +8     
  Misses        261      261           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[gmlewis]

@sushant-me - can you please increase the CodeCov results for this critical piece of code?

[sushant-me]

@gmlewis done - added TestRepositoriesService_UploadReleaseAssetFromRelease_MalformedUploadURL, which exercises the url.Parse error return (a URL with an ASCII control character makes net/url refuse it). That was the uncovered line in repos_releases.go, so patch coverage should now be 100%. go test ./github/ and ./script/lint.sh both pass locally.

[gmlewis]

Thank you, @sushant-me!
LGTM.
Awaiting second LGTM+Approval from any other contributor to this repo before merging.

cc: @stevehipwell - @Not-Dhananjay-Mishra

[sushant-me]

Thanks for the LGTM, @gmlewis! Everything is green CLA, codecov patch/project, and the full test matrix and the branch is current with master, so this is ready for a second LGTM whenever someone has bandwidth. Happy to make any adjustments if something needs changing.