[Pipeline Bug]: Pipeline can at random replace parts of InstallerUrl-s with *'s, breaking the validation completely.

Directly based on https://github.com/microsoft/winget-pkgs/pull/400248#issuecomment-4931767859.

For some reason, and under seemingly very, very rare circumstances, the pipeline can replace seemingly random parts of InstallerUrl-s with asterisks, causing the pipeline to fail practically instantly. In the case of the linked-to PR, it seemingly interpreted `https://cdn.winget.microsoft.com/fonts/source2.msix` as `https://cdn.***.microsoft.com/fonts/source2.***ix`.

Log: https://dev.azure.com/shine-oss/8b78618a-7973-49d8-9174-4360829d979b/_apis/build/builds/362764/logs/37

Start with the linked winget-pkgs pull request comment and Azure DevOps pipeline log 362764, focusing on where the InstallerUrl is transformed or validated. Reproduce or isolate the rare asterisk substitution, then verify that valid URLs remain unchanged and the affected pipeline validation succeeds.

Written by the indexing model from the issue text.