Fix credentials detection for UrlSanitizer

What does this MR do and why?

Contributes to #347562 (closed)

Problem

We ignore raw credentials from URL if credentials are explicitly provided as a hash to UrlSantizer.new(url, credentials: { user: <user>, password: <password> }).

Solution

Collect credentials from both URL and credentials hash. Values from credentials hash have preference.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.