Harden uv-build asset handling

Agent-Logs-Url: https://github.com/version-fox/vfox-python/sessions/016602d1-26fe-4323-9761-716964a16a9c

Co-authored-by: bytemain <13938334+bytemain@users.noreply.github.com>

Author: Copilot

lib/util.lua

@@ -363,6 +363,9 @@ local function uvBuildVersion(build)
     if build.display_version ~= nil then
         return build.display_version
     end
+    if build.version == nil then
+        return nil
+    end
     if build.variant == "freethreaded" then
         return build.version .. "t"
     end
@@ -470,6 +473,10 @@ local function verifyUvBuildArchive(path, sha256)
 end
 
 local function uvBuildDownloadUrl(build)
+    if not isHttpsUrl(build.url) then
+        error("Invalid uv-build download URL")
+    end
+
     local mirror = os.getenv(UV_BUILD_MIRROR_ENV)
     if mirror == nil or mirror == "" then
         return build.url