pub(super) fn web_url(value: &str) -> Option<Url>
Admits ordinary public website links while excluding executable schemes and credentials. This does not authorize a fetch; discovery continues to require the HTTPS transport policy.