Ignore pyproject index username in lockfile comparison

[jkipper]

Summary

Pyproject.toml index url may contain a username while lockfile doesn't. Treat it as the same index to prevent unintended package updates

Fixes #16436

[zanieb]

Do you have an integration test, e.g., for uv lock that demonstrates that this fixes #16436 ?

[jkipper]

Not directly, turns out I did not add the part that actually caused the issue in that. Still not sure why I found that correlation but it's not happening that way anymore and the username part is what I was actually seeing. (I originally reported that issue)

[zanieb]

Sorry I don't quite understand what you mean.

[jkipper]

I reported that issue based on my observation that it was related to which sort of packaging was used, but the upgrade was actually caused by adding a username to an index.

So this fixes the linked issue, but the actual cause wasn't included when I reported it.

[zanieb]

I think we need an integration test case that demonstrates the change in behavior this pull request causes, i.e., at the uv lock level

[jkipper]

Got it. Added one now.

[konstin]

Thank you!