[management] Reject a port-only authority in the debug upload URL

DebugUpload.Validate checked url.Host, which is non-empty for an authority like
":443" even though there is no host. Management would store and publish it, and
every peer would then refuse it: the client-side rule the same value meets on
the CLI path already uses Hostname() for exactly this reason
(profilemanager.ValidateBundleUploadURL).

Reported by cubic on #7514.

management/internals/server/config/config.go

@@ -247,7 +247,10 @@ func (d DebugUpload) Validate() error {
 	if parsed.Scheme != "https" {
 		return fmt.Errorf("debug upload URL must use https, got scheme %q", parsed.Scheme)
 	}
-	if parsed.Host == "" {
+	// Hostname(), not Host: an authority like ":443" is non-empty but has no
+	// host, and the peers reject it (see profilemanager.ValidateBundleUploadURL).
+	// Management must not publish a destination its own clients refuse.
+	if parsed.Hostname() == "" {
 		return errors.New("debug upload URL must have a host")
 	}
 

management/internals/server/config/debug_upload_test.go

@@ -21,6 +21,8 @@ func TestDebugUploadValidate(t *testing.T) {
 		{name: "http refused", url: "http://upload.example.com/upload-url", wantErr: "must use https"},
 		{name: "scheme-less refused", url: "upload.example.com/upload-url", wantErr: "must use https"},
 		{name: "host-less refused", url: "https:///upload-url", wantErr: "must have a host"},
+		// ":443" is a non-empty authority with no host; the peers refuse it.
+		{name: "port-only authority refused", url: "https://:443/upload-url", wantErr: "must have a host"},
 		{name: "unparsable refused", url: "https://upload.example.com:port", wantErr: "parse debug upload URL"},
 	}