Add behavior tests that assert URL validation runs before network
requests and that unsafe URLs never reach requests.get. Also fix
indentation in _wait_for_pypi after the requests migration.
Co-authored-by: Rip&Tear <theCyberTech@users.noreply.github.com>