[JENKINS-73506] Reject fetch requests that use credentials with HTTP in FIPS mode

[PereBueno]

JENKINS-73506 - Checks for FIPS compliance in AbstractSCMSource

This is a follow-up of #1611

That PR left a case without covering: SCMSources could be configured with invalid values and, when fetched (e.g. multibranch pipelines) credentials could be leaked.

IllegalArgumentException throwing has no effect here (other than the logs), as MBPs handle that, so failures would be transparent to the user, also credentials could come from other sources (e.g. GIT_PASSWORD). Form validation is still in place and wasn't modified.

Therefore, in this case we are interrupting fetch operation, so we can be sure credentials are not leaked.

When trying to fetch a remote with credentials and an insecure URL we will

• Log as SEVERE
• Interrupt the fetch operation
• Add the same log message to the TaskListener so it's show in the UI.

Added a unit test checking fetch is interrupted.

Also tested manually and checked fetching is interrupted as expected

Started by user unknown or anonymous
[Wed Jul 31 17:55:15 CEST 2024] Starting branch indexing...
 > git --version # timeout=10
 > git --version # 'git version 2.38.1'
using GIT_ASKPASS to set credentials 
 > git ls-remote --symref -- http://github.com/XXX/YYY # timeout=10
ERROR: Invalid configuration will not fetch any remote. FIPS requires to use git URL with TLS.
ERROR: [Wed Jul 31 17:55:18 CEST 2024] Could not fetch branches from source d3e00ee6-4048-472e-8931-391280660dc6
[Wed Jul 31 17:55:18 CEST 2024] Finished branch indexing. Indexing took 2.6 sec
Aborted
Finished: ABORTED

Checklist

• I have read the CONTRIBUTING doc
• I have referenced the Jira issue related to my changes in one or more commit messages
• I have added tests that verify my changes
• Unit tests pass locally with my changes
• I have added documentation as necessary
• No Javadoc warnings were introduced with my changes
• No spotbugs warnings were introduced with my changes
• Documentation in README has been updated as necessary
• Online help has been added and reviewed for any new or modified fields
• I have interactively tested my changes
• Any dependent changes have been merged and published in upstream modules (like git-client-plugin)

Types of changes

What types of changes does your code introduce?

• New feature (non-breaking change which adds functionality)

[MarkEWaite]

Two optional comments that do not block merge.

[olamy]

some changes proposed here PereBueno#1
this one #1615 (comment) is a bit optional

[MarkEWaite]

Thanks!

[daniel-beck]

@Restricted(NoExternalUse.class)?