[client] Validate the resolved remote-job upload destination, not just the requested one

validateBundleUploadURL ran on the job's URL or the MDM override and then
ResolveUploadURL folded in the destination published by management, which never
met the same check. A malformed or plaintext published value therefore slipped
through resolution and failed later inside UploadDebugBundle's requireHTTPS,
surfacing as a transport error instead of a validation one. Management validates
at write time, so this only bites against an older or mismatched server — but
the two destinations are interchangeable and should be held to one rule.

Reported by cubic on #7514.

client/internal/engine.go

@@ -1488,12 +1488,17 @@ func (e *Engine) handleBundle(params *mgmProto.BundleParameters) (*mgmProto.JobR
 		log.Infof("using MDM debug bundle upload URL override instead of the management-supplied value")
 		uploadURL = override
 	}
+	uploadURL = debug.ResolveUploadURL(uploadURL, e.DebugUploadURL())
+
+	// Validated after resolution, so the destination this deployment published
+	// meets the same rule as one named in the job. Management validates it at
+	// write time, but a peer can be talking to an older or mismatched server,
+	// and a bad value should surface here rather than as a transport error
+	// halfway through the upload.
 	if err := validateBundleUploadURL(uploadURL); err != nil {
 		return nil, err
 	}
 
-	uploadURL = debug.ResolveUploadURL(uploadURL, e.DebugUploadURL())
-
 	bundleDeps := debug.GeneratorDependencies{
 		InternalConfig: e.config.ProfileConfig,
 		StatusRecorder: e.statusRecorder,