fix(workspace): honor explicit provider host when injecting git clone tokens

[rsd-darshan]

HUMAN:

Ran the workspace test suite locally (61 tests, incl. the new self-hosted GitLab cases) plus ruff, pyright, and pre-commit before pushing.

---

AGENT:

Why

_build_clone_url only injects the auth token into a full clone URL when the URL's host matches the provider's hardcoded public SaaS domain (gitlab.com, github.com, bitbucket.org). A self-hosted instance (e.g. https://gitlab.mycompany.com/owner/repo) never matches, so the token is silently dropped and the clone goes out unauthenticated and fails.

That exact-host check exists intentionally, to stop an auto-detected provider from leaking a token into a lookalike host (github.com.evil.com). The fix distinguishes the two cases instead of removing the check:

• Auto-detected provider (from the URL itself): keeps the existing exact-match-only behavior, so lookalike hosts still never get a token.
• Explicitly configured provider (RepoSource.provider set by the caller): the pairing of url + provider was authored directly by the caller, not derived from an untrusted URL, so the token is now injected using the URL's own host.

_clone_single_repo passes explicit_provider=repo.provider is not None through to _build_clone_url to make this distinction.

Summary

• Self-hosted git providers (explicit provider field) now get the token injected using the URL's actual host, instead of requiring an exact match against the canonical public SaaS domain.
• Auto-detected providers keep the exact-host-only check, so the anti-phishing protection against lookalike domains is unchanged.

Issue Number

Fixes #4543

How to Test

uv run pytest tests/workspace/test_cloud_workspace_repos.py -q — 61 passed, including:

• test_build_clone_url_self_hosted_gitlab_with_explicit_provider — token injected for self-hosted GitLab with explicit provider
• test_build_clone_url_self_hosted_host_without_explicit_provider — no token when provider isn't explicit
• test_build_clone_url_lookalike_host_not_injected — regression: lookalike host never gets a token
• test_clone_self_hosted_gitlab_with_token — end-to-end clone_repos() call asserting the authenticated URL passed to git clone

Also ran uv run ruff check / ruff format --check on the changed files, and the repo's pre-commit hooks (ruff, pyright, import-dependency rules, tool registration) — all clean.

Type

• Bug fix

Notes

None.

[all-hands-bot]

👋 This PR needs a couple of things fixed before OpenHands can review it:

• the PR description's HUMAN: section needs at least 20 characters describing what you tested, not just the template placeholder

Push an update once this is addressed and this check re-runs automatically.

This is an automated check - no AI was used to generate this comment.

[all-hands-bot]

🚦 CI is currently failing on this PR's latest commit.

Please fix the failing checks before OpenHands reviews it - this is re-checked automatically once you push a new commit. (A maintainer can also request @all-hands-bot as a reviewer to have it reviewed regardless of CI status.)

This is an automated check - no AI was used to generate this comment.

[VascoSch92]

LGTM!

thanks!

I just corrected a couple of nits.