fix: mask_url returns a malformed url unchanged instead of raising

the 0030dae rewrite dropped the try/except ValueError guard around urlsplit, so a
malformed url (an unbalanced ipv6 literal like http://[::1) raised ValueError out of a
display/logging masker instead of being returned unchanged - crashing the log call it
feeds. restore the guard: urlsplit failure returns the input verbatim, matching the
module's fail-safe display-only intent. a valid url still strips query+fragment.

Signed-off-by: disqualifier <dev@disqualifier.me>

src/commons/masking.py

@@ -73,9 +73,14 @@ def mask_url(url: str) -> str:
 
     does NOT parse or hunt for sensitive params - it simply drops everything after the
     path, so it structurally cannot leak a query param and cannot over-mask a legit one.
-    a url with no query/fragment is returned unchanged.
+    a url with no query/fragment is returned unchanged; a url urlsplit cannot parse
+    (a malformed ipv6 literal) is also returned unchanged rather than crashing the
+    display/log call this feeds.
     """
-    parts = urlsplit(url)
+    try:
+        parts = urlsplit(url)
+    except ValueError:
+        return url
     return urlunsplit((parts.scheme, parts.netloc, parts.path, "", ""))