fix(gitlab): stop leaking the API token on redirect and globbing project paths

Two narrow hardening fixes on top of the GitLab provider work.

gitlab_api/gitlab_api_capture passed --location while supplying the API
token through `header = "PRIVATE-TOKEN: ..."`. curl strips only the
Authorization header on a cross-host redirect, so a 3xx from a
self-managed instance would resend the token to whatever host it named.
These are plain /api/v4 GETs against the configured base URL and have no
reason to follow a redirect off it, so drop -L.

GITLAB_PROJECTS was iterated as `for project in $GITLAB_PROJECTS`, which
is subject to pathname expansion as well as word splitting. A plausible
entry like `group/*` expands against the process CWD, so the advisory
queue/stats/public-visibility scans would query whatever directory names
happened to match. Split the list with `read -a` instead and emit only
well-formed namespace/project paths. The field is telemetry-only and does
not define runner scope, so a malformed entry is skipped rather than
failing validation and blocking a fleet.

gitlab_stats_refresh reads its project list on fd 3 because its
per-project status scan is itself a `while read` on stdin.

Author: elibosley

.gstack/browse-audit.jsonl

@@ -0,0 +1,34 @@
+[2026-07-01T20:46:48.181Z] [debug] [UnifiedMount] Mounted 1 components
+[2026-07-01T20:46:48.284Z] [debug] [ThemeInitializer] Theme initialized successfully
+[2026-07-01T20:46:49.938Z] [debug] [UnifiedMount] Mounted 5 components
+[2026-07-01T20:46:49.980Z] [debug] [setServer] {array: Object, apiKey: , apiVersion: , avatar: , caseModel: mid-tower}
+[2026-07-01T20:46:50.139Z] [debug] [ThemeInitializer] Theme initialized successfully
+[2026-07-01T20:46:50.237Z] [log] [use-notifications] set haveSeenNotifications to false
+[2026-07-01T20:46:50.589Z] [debug] mutateServerStateFromApi {config: Object, info: Object, owner: Object, registration: Object, vars: Object}
+[2026-07-01T20:46:50.589Z] [debug] mutatedData {username: , registered: false, name: Titan, keyfile: kqR1vJ3eUzBObUHUa9t_aMalovVhN5M24gdhMjgwQc7FYg3NLg…m26w9NcVGVWqCxp5PXmhstmyFe4-p-N2_s4sJeDxiRf0s9dQg, bootedFromFlashWithInternalBootSetup: false}
+[2026-07-01T20:46:50.589Z] [debug] [setServer] {username: , registered: false, name: Titan, keyfile: kqR1vJ3eUzBObUHUa9t_aMalovVhN5M24gdhMjgwQc7FYg3NLg…m26w9NcVGVWqCxp5PXmhstmyFe4-p-N2_s4sJeDxiRf0s9dQg, bootedFromFlashWithInternalBootSetup: false}
+[2026-07-01T20:47:02.691Z] [debug] [UnifiedMount] Mounted 5 components
+[2026-07-01T20:47:02.766Z] [debug] [setServer] {array: Object, apiKey: , apiVersion: , avatar: , caseModel: mid-tower}
+[2026-07-01T20:47:03.261Z] [debug] [ThemeInitializer] Theme initialized successfully
+[2026-07-01T20:47:03.393Z] [debug] mutateServerStateFromApi {config: Object, info: Object, owner: Object, registration: Object, vars: Object}
+[2026-07-01T20:47:03.393Z] [debug] mutatedData {username: , registered: false, name: Titan, keyfile: kqR1vJ3eUzBObUHUa9t_aMalovVhN5M24gdhMjgwQc7FYg3NLg…m26w9NcVGVWqCxp5PXmhstmyFe4-p-N2_s4sJeDxiRf0s9dQg, bootedFromFlashWithInternalBootSetup: false}
+[2026-07-01T20:47:03.393Z] [debug] [setServer] {username: , registered: false, name: Titan, keyfile: kqR1vJ3eUzBObUHUa9t_aMalovVhN5M24gdhMjgwQc7FYg3NLg…m26w9NcVGVWqCxp5PXmhstmyFe4-p-N2_s4sJeDxiRf0s9dQg, bootedFromFlashWithInternalBootSetup: false}
+[2026-07-01T20:47:03.641Z] [log] [use-notifications] set haveSeenNotifications to false
+[2026-07-01T20:47:04.107Z] [debug] [UnifiedMount] Mounted 5 components
+[2026-07-01T20:47:04.158Z] [debug] [setServer] {array: Object, apiKey: , apiVersion: , avatar: , caseModel: mid-tower}
+[2026-07-01T20:47:04.194Z] [debug] [ThemeInitializer] Theme initialized successfully
+[2026-07-01T20:47:04.299Z] [log] [use-notifications] set haveSeenNotifications to false
+[2026-07-01T20:47:04.764Z] [debug] mutateServerStateFromApi {config: Object, info: Object, owner: Object, registration: Object, vars: Object}
+[2026-07-01T20:47:04.764Z] [debug] mutatedData {username: , registered: false, name: Titan, keyfile: kqR1vJ3eUzBObUHUa9t_aMalovVhN5M24gdhMjgwQc7FYg3NLg…m26w9NcVGVWqCxp5PXmhstmyFe4-p-N2_s4sJeDxiRf0s9dQg, bootedFromFlashWithInternalBootSetup: false}
+[2026-07-01T20:47:04.764Z] [debug] [setServer] {username: , registered: false, name: Titan, keyfile: kqR1vJ3eUzBObUHUa9t_aMalovVhN5M24gdhMjgwQc7FYg3NLg…m26w9NcVGVWqCxp5PXmhstmyFe4-p-N2_s4sJeDxiRf0s9dQg, bootedFromFlashWithInternalBootSetup: false}
+[2026-07-01T20:47:27.022Z] [debug] [UnifiedMount] Mounted 5 components
+[2026-07-01T20:47:27.098Z] [debug] [setServer] {array: Object, apiKey: , apiVersion: , avatar: , caseModel: mid-tower}
+[2026-07-01T20:47:27.143Z] [debug] [ThemeInitializer] Theme initialized successfully
+[2026-07-01T20:47:27.294Z] [log] [use-notifications] set haveSeenNotifications to false
+[2026-07-01T20:47:27.848Z] [debug] [UnifiedMount] Mounted 5 components
+[2026-07-01T20:47:27.887Z] [debug] [setServer] {array: Object, apiKey: , apiVersion: , avatar: , caseModel: mid-tower}
+[2026-07-01T20:47:27.993Z] [debug] [ThemeInitializer] Theme initialized successfully
+[2026-07-01T20:47:28.116Z] [log] [use-notifications] set haveSeenNotifications to false
+[2026-07-01T20:47:28.537Z] [debug] mutateServerStateFromApi {config: Object, info: Object, owner: Object, registration: Object, vars: Object}
+[2026-07-01T20:47:28.537Z] [debug] mutatedData {username: , registered: false, name: Titan, keyfile: kqR1vJ3eUzBObUHUa9t_aMalovVhN5M24gdhMjgwQc7FYg3NLg…m26w9NcVGVWqCxp5PXmhstmyFe4-p-N2_s4sJeDxiRf0s9dQg, bootedFromFlashWithInternalBootSetup: false}
+[2026-07-01T20:47:28.538Z] [debug] [setServer] {username: , registered: false, name: Titan, keyfile: kqR1vJ3eUzBObUHUa9t_aMalovVhN5M24gdhMjgwQc7FYg3NLg…m26w9NcVGVWqCxp5PXmhstmyFe4-p-N2_s4sJeDxiRf0s9dQg, bootedFromFlashWithInternalBootSetup: false}