Drop credentials from sysroot index URLs

When retrieving artifacts requires authentication, the $IMAGE_URL_PREFIX may end up containing the credentials. In that case we do not want those credentials to end up in the index file that gets uploaded on the server to link to the latest sysroots.