mask credentials in malwarelist urls and prevent log poisoning

[123Haynes]

@bitterpanda63 a small followup to #365 that i missed yesterday.
Since users can now provide custom malware list urls, it is also possible that they provide URLs with basic auth credentials if their mirror requires these.
We don't want to log these credentials.
I also added some basic protection against log poisoning since this is a user provided value.

Current behaviour: safe-chain may log this: https://user:pass@cli-mirror.com\nmalicious
With this pr it will log this: https://***@cli-mirror.commalicious

Summary by Aikido

Security Issues: 0	Quality Issues: 0	Resolved Issues: 0

⚡ Enhancements

• Added function to mask credentials and remove control characters.
• Replaced malware list logging with masked URLs to prevent credential exposure.

^{More info}