Fix nested credential path scope matching

[ttys3]

Summary

• support slash-boundary-aware credential scopes at arbitrary path depth while preserving exact matches and first-match precedence
• align stored credential URL parsing and percent decoding with Git v2.55.0 behavior
• reject ambiguous dot-segment scope inheritance and path-prefix collisions
• keep passwords and malformed credential contents out of debug logs, and use 0600 permissions on POSIX systems
• document credential.useHttpPath, credential ordering, the scope extension, and the relevant official Git references

Motivation

PR #4 identified the need for multi-level GitLab group credentials. This implementation addresses that use case without raw strings.HasPrefix matching, which could allow group/sub to match group/submarine or an empty path to match every repository.

Git's built-in credential store uses exact field matching. This helper retains exact matching and adds slash-delimited path scopes as an explicit, documented project-specific extension.

Testing

• git diff --check
• go test -count=1 ./...
• go vet ./...
• go test -count=1 -race ./...
• go test -count=100 ./...
• go test -cover ./... (61.1%)
• differential checks against Git v2.55.0 URL parsing and decoding behavior
• gitleaks scan of the resulting commit (no leaks found)