Reject an invalid host in auth login and auth token (#7195)

## Changes
`databricks auth login` and `databricks auth token` reject a host that
is not an http(s) URL with a hostname,
e.g. `/`, `?o=123`, `https://` or `ftp://x.test`, with
`invalid host "<input>". Expected a URL like
https://<databricks-instance>.cloud.databricks.com`.

The check covers `--host`, the positional argument, profile hosts and
the host prompt, which shows the error
and asks again. `auth login` runs it before the keyring probe and the
profile name prompt.

Behavior changes:
- An empty host after "Enter a host URL manually" in the login profile
picker no longer starts discovery login.
- `auth login --skip-workspace --host '?a=123'` fails. On main this
started discovery login.
- Spaces around a host are trimmed, so `" https://x.test/?o=1 "` works
and keeps the workspace ID.

## Why
Follow-up to a review comment on #7179. An invalid host made login and
token resolve the host from
`DATABRICKS_HOST`, save a profile without a `host` key, connect to a
host named `https`, or fail later
with `host must start with 'https://': `.

## Tests
Unit tests cover host validation for each host source, the host prompt,
and the early rejection in browser,
device code and `--skip-workspace` login. New acceptance tests check the
error output of `auth login` and
`auth token`.

This pull request and its description were written by Isaac.

---------

Co-authored-by: Isaac <no-reply@databricks.com>

Author: maksim-zuev-db

.nextchanges/cli/login-reject-empty-host.md

@@ -0,0 +1 @@
+* `databricks auth login` and `databricks auth token` now reject a host that is not a URL with a hostname, such as `/`, `?o=123` or `https://`, instead of falling back to `DATABRICKS_HOST` or failing later. An empty host after "Enter a host URL manually" in the login profile picker no longer starts discovery login. ([#7195](https://github.com/databricks/cli/pull/7195))

acceptance/cmd/auth/login/invalid-host/out.test.toml

@@ -0,0 +1 @@
+Cloud = false

acceptance/cmd/auth/login/invalid-host/output.txt

@@ -0,0 +1,6 @@
+
+>>> musterr [CLI] auth login --host ?o=123 --profile test
+Error: invalid host "?o=123". Expected a URL like https://<databricks-instance>.cloud.databricks.com
+
+>>> musterr [CLI] auth login --host https:// --profile test
+Error: invalid host "https://". Expected a URL like https://<databricks-instance>.cloud.databricks.com

acceptance/cmd/auth/login/invalid-host/script

@@ -0,0 +1,9 @@
+sethome "./home"
+
+# A host that is empty without its query params is rejected before login
+# can fall back to discovery or DATABRICKS_HOST.
+trace musterr $CLI auth login --host '?o=123' --profile test
+
+# A host without a hostname is rejected instead of being read as a host
+# named "https".
+trace musterr $CLI auth login --host 'https://' --profile test

acceptance/cmd/auth/login/invalid-host/test.toml

@@ -0,0 +1,3 @@
+Ignore = [
+    "home"
+]

acceptance/cmd/auth/token/invalid-host/out.test.toml

@@ -0,0 +1 @@
+Cloud = false

acceptance/cmd/auth/token/invalid-host/output.txt

@@ -0,0 +1,6 @@
+
+>>> musterr [CLI] auth token --host ?o=123
+Error: invalid host "?o=123". Expected a URL like https://<databricks-instance>.cloud.databricks.com
+
+>>> musterr [CLI] auth token --host https://
+Error: invalid host "https://". Expected a URL like https://<databricks-instance>.cloud.databricks.com

acceptance/cmd/auth/token/invalid-host/script

@@ -0,0 +1,13 @@
+sethome "./home"
+
+unset DATABRICKS_HOST
+unset DATABRICKS_TOKEN
+unset DATABRICKS_CONFIG_PROFILE
+
+# A host that is empty without its query params is rejected instead of
+# falling back to DATABRICKS_HOST.
+trace musterr $CLI auth token --host '?o=123'
+
+# A host without a hostname is rejected instead of being read as a host
+# named "https".
+trace musterr $CLI auth token --host 'https://'

acceptance/cmd/auth/token/invalid-host/test.toml

@@ -0,0 +1,3 @@
+Ignore = [
+    "home"
+]

cmd/auth/auth.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"strings"
 
 	"github.com/databricks/cli/libs/auth"
 	"github.com/databricks/cli/libs/cmdio"
@@ -50,10 +51,20 @@ func promptForHost(ctx context.Context) (string, error) {
 	// promptui's screenbuf does not account for terminal line wrapping, and a
 	// long "label + value" line that wraps causes each keystroke to leave a
 	// stale render on screen instead of overwriting the previous one.
-	cmdio.LogString(ctx, "Example: https://<databricks-instance>.cloud.databricks.com")
-	return cmdio.RunPrompt(ctx, cmdio.PromptOptions{
+	cmdio.LogString(ctx, "Example: "+exampleHost)
+	result, err := cmdio.RunPrompt(ctx, cmdio.PromptOptions{
 		Label: "Databricks host",
+		Validate: func(input string) error {
+			if strings.TrimSpace(input) == "" {
+				return errors.New("host is required")
+			}
+			// Reject hosts that setHost would reject after the prompt,
+			// e.g. "/" or "?o=123", while the user can still edit them.
+			_, err := parseLoginHost(input)
+			return err
+		},
 	})
+	return strings.TrimSpace(result), err
 }
 
 func promptForAccountID(ctx context.Context) (string, error) {