fix(sanitizer): handle password clearing in URI

Starting from v1.0.4, the uri gem clears the password instance variable when the user setter is called (see https://github.com/ruby/uri/blob/52077e9b07c555de6ad7ee74663b988fa38ca545/lib/uri/generic.rb#L525C11-L525C12):

    def set_user(v)
      set_userinfo(v, nil)
      v
    end

The 2nd argument in set_user_info is password. To preserve the current behavior, we store the password in a temporary variable.