fix: use proper URL parsing for GitHub API domain

Replace substring check with urlparse hostname comparison to prevent
potential bypass via crafted URLs. Resolves CodeQL alert
py/incomplete-url-substring-sanitization (CWE-20):

https://github.com/python-wheel-build/fromager/security/code-scanning/1

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Martin Prpič <mprpic@redhat.com>

Author: mprpic

src/fromager/http_retry.py

@@ -18,6 +18,7 @@
 import random
 import time
 import typing
+from urllib.parse import urlparse
 
 import requests
 from requests.adapters import HTTPAdapter
@@ -156,7 +157,7 @@ def send(
                 if (
                     response.status_code == 403
                     and request.url is not None
-                    and "api.github.com" in request.url
+                    and urlparse(request.url).hostname == "api.github.com"
                     and "rate limit" in response.text.lower()
                 ):
                     self._handle_github_rate_limit(response, attempt, max_attempts)