The postgres image's default pair in compose files and CI DATABASE_URLs
blocked pushes as db.url_with_password HIGH. It is now exempt only for
postgres/postgresql URLs with exactly postgres:postgres on localhost or
127.0.0.1 (optional port). A bare single-label host (`db`, `postgres`), any
other host, a host that merely starts with localhost (`localhost.evil...`,
`localhost@prod-db`), any other user or password, and other schemes still
block. #2913 exempted the pair on any host; this keeps the plan's narrower
rule.
Co-authored-by: mb1810 <michael.berger1810@gmail.com>
