fix: mask proxy URL credentials in job logs

Basic-auth userinfo in the http-proxy input or HTTP(S)_PROXY environment
variables was never registered as a secret, so error messages carrying
the proxy URL printed the credentials unmasked in the job log.

test/index.test.ts

@@ -1267,6 +1267,21 @@ describe('Configure AWS Credentials', {}, () => {
 
       expect(core.setFailed).not.toHaveBeenCalled();
     });
+
+    it('masks credentials embedded in the proxy URL', async () => {
+      vi.mocked(core.getInput).mockImplementation(
+        mocks.getInput({
+          ...mocks.GH_OIDC_INPUTS,
+          'http-proxy': 'http://user:secretpass@proxy.example.com:8080',
+        }),
+      );
+
+      await run();
+
+      expect(core.setSecret).toHaveBeenCalledWith('user');
+      expect(core.setSecret).toHaveBeenCalledWith('secretpass');
+      expect(core.setFailed).not.toHaveBeenCalled();
+    });
   });
 
   describe('AWS Profile Support', {}, () => {