Replace unsafe URL substring assertions in provider tests #67

Affected version

ml4t-data 0.1.8 and current main.

Finding

CodeQL reports three high-severity py/incomplete-url-substring-sanitization findings in provider tests. The tests accept a hostname merely because its text appears somewhere in a URL, which does not establish the URL scheme, authority, or exact host.

These are test-contract weaknesses rather than evidence that production requests accept attacker-controlled hosts, but stable qualification requires resolving open high findings.

Acceptance criteria

• Parse each provider URL structurally.
• Assert HTTPS and the exact expected hostname.
• Assert relevant path structure where the provider contract requires it.
• Pass focused provider tests, CodeQL, and the full protected CI matrix.
• Verify the three default-branch alerts close after merge.