Fix security and quality alerts outside vendored code

[matteius]

Summary

• Replace substring checks in test_various_vcs_url_formats with exact processed URL assertions, addressing CodeQL alerts #19 and #20.
• Update the development virtualenv lock entry from 21.2.0 to 21.7.13 in Pipfile.lock and pylock.toml, addressing Dependabot alerts #184, #185, #186, and #187. The artifact hashes and URLs were checked against PyPI.

Findings under pipenv/vendor and pipenv/patched are outside this PR's requested scope.

Validation

• python -m pytest -o addopts='' tests/unit/test_vcs.py -q (22 passed)
• pipenv pylock --validate
• pipenv verify
• git diff --check