Trim whitespace out of the registry and spec urls

A registry with a stray space or newline passed validation and was
concatenated verbatim into the archive URL, so curl saw the malformed
address instead of the user seeing the required-registry error. Trim the
value before matching and reject any whitespace left inside it; apply the
same to a spec's explicit url.

lua/arti-pack/spec.lua

@@ -51,8 +51,15 @@ function M.parse(entry)
     return nil, string.format('%s resolves to an unusable directory name %q', source, tostring(name))
   end
 
-  if entry.url ~= nil and type(entry.url) ~= 'string' then
-    return nil, string.format('%s has a non-string url', source)
+  local url = entry.url
+  if url ~= nil then
+    if type(url) ~= 'string' then
+      return nil, string.format('%s has a non-string url', source)
+    end
+    url = trim(url)
+    if url == '' or url:find('%s') then
+      return nil, string.format('%s has an invalid url %q', source, entry.url)
+    end
   end
 
   return {
@@ -63,21 +70,27 @@ function M.parse(entry)
     tag = tag,
     ext = ext,
     opt = entry.opt == true,
-    url = entry.url,
+    url = url,
   }
 end
 
 -- There is no default registry: the URL is site-specific, and a wrong one only
--- surfaces as an opaque curl failure. Returns the base with trailing slashes
--- stripped so joining it to a path never produces "//".
+-- surfaces as an opaque curl failure. Returns the base trimmed and with trailing
+-- slashes stripped so joining it to a path never produces "//".
 function M.check_registry(registry)
   if registry == nil then
     return nil, 'registry is not configured; ' .. SETUP_HINT
   end
-  if type(registry) ~= 'string' or not registry:match('^https?://[^%s/]') then
-    return nil, string.format('registry %s is not an http(s) URL; %s', vim.inspect(registry), SETUP_HINT)
+  local bad = string.format('registry %s is not an http(s) URL; %s', vim.inspect(registry), SETUP_HINT)
+  if type(registry) ~= 'string' then
+    return nil, bad
   end
-  return (registry:gsub('/+$', ''))
+  -- Whitespace left inside the URL would be baked into every download.
+  local base = trim(registry)
+  if not base:match('^https?://[^%s/]') or base:find('%s') then
+    return nil, bad
+  end
+  return (base:gsub('/+$', ''))
 end
 
 -- Tagged source archives live at the same path shape on every GitHub-alike, so