Add URL fragment validation option

[ChiragAgg5k]

What does this PR do?

• Adds an optional allowFragments flag to Utopia\Validator\URL, defaulting to true for backwards compatibility.
• Rejects URL fragments when the flag is disabled, including empty fragments such as https://example.com/callback#.
• Updates URL validator tests for default fragment support and fragment-disabled validation.

Test Plan

• composer test
• composer test -- --filter URLTest
• composer lint

[greptile-apps]

Greptile Summary

This PR extends the URL validator with an allowFragments flag (default true) that rejects URL fragments — including the empty-fragment case (#) — when disabled. Backward compatibility is preserved by defaulting to true.

• src/Validator/URL.php: adds the allowFragments constructor parameter, updates getDescription() to append "and without a fragment component" when needed, and adds a parse_url(PHP_URL_FRAGMENT) !== null guard in isValid().
• tests/Validator/URLTest.php: adds testDisallowFragments and testDisallowFragmentsAllowedSchemes covering valid URLs, non-empty fragments, empty fragments, and scheme restrictions; also adds a fragment URL to the default-allow test.

Confidence Score: 5/5

Safe to merge — the change is additive, backward-compatible, and the fragment-detection logic is correct for both populated and empty fragments.

The new flag defaults to true, leaving all existing callers unaffected. The parse_url(PHP_URL_FRAGMENT) !== null guard correctly handles populated fragments (string), empty fragments (empty string ''), and missing fragments (null), all of which are exercised by the new tests.

No files require special attention.

Important Files Changed

Filename	Overview
src/Validator/URL.php	Adds allowFragments constructor param (default true for backwards compat) with correct parse_url(PHP_URL_FRAGMENT) !== null guard that rejects both populated and empty (#) fragments.
tests/Validator/URLTest.php	Adds two new test methods covering fragment-disallowed mode standalone and with scheme restrictions, including the empty-fragment edge case.

_{Reviews (2): Last reviewed commit: "Add URL fragment validation option" | Re-trigger Greptile}