scm: make ScmOverride hashable with nested values

[mahaase]

Problem

scmOverrides allows arbitrary values in match and set (schema {str: object}).
A natural use case is injecting authentication headers into a url SCM so that
downloads from a private server work — matched by host and kept out of the
version-controlled recipe:

scmOverrides:
   - match:
       url: "https://gitea.example.com/*"
     set:
       headers:
         Authorization: "token <personal access token>"

This crashes as soon as the override actually matches:

  File ".../bob/scm/scm.py", line 58, in __hash__
    frozenset(self.__set.items()), frozenset(self.__replace.items())))
TypeError: unhashable type: 'dict'

ScmOverride.__hash__ builds a frozenset directly from the raw match/set
items. A nested dict/list value (like headers) is unhashable, and since
matched overrides are collected into a set() in the builder
(builder.getActiveOverrides()), any build that hits such an override fails.

Fix

Recursively freeze nested dict/list values into frozenset/tuple before
hashing. __eq__ already compares the raw structures correctly and is left
unchanged.

Tests

Added two regression tests to test/unit/test_input_scmoverride.py:

• a set with a nested headers dict is hashable and behaves correctly in a
  set() (equal overrides collapse, unequal ones stay distinct);
• the nested value is injected verbatim into the matched SCM.

Note

This came out of a discussion about a proposed urlCredentials config option.
With this fix, authenticated url SCMs can be handled entirely through the
existing headers attribute + scmOverrides (kept in a git-ignored
user.yaml), so no dedicated credentials setting is needed.

[codecov]

Codecov Report

❌ Patch coverage is 85.71429% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 89.25%. Comparing base (7b00892) to head (356c155).

Files with missing lines	Patch %	Lines
pym/bob/scm/scm.py	85.71%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #704      +/-   ##
==========================================
+ Coverage   89.23%   89.25%   +0.01%     
==========================================
  Files          50       50              
  Lines       16450    16456       +6     
==========================================
+ Hits        14679    14687       +8     
+ Misses       1771     1769       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jkloetzke]

Wouldn't it be more natural to add support for "user:password" standard basic authentication in the URL?

Regarding the "token" field, this seems to be a non standard header. You can already add custom headers to an URL SCM. This should even work through scmOverride...

[mahaase]

Wouldn't it be more natural to add support for "user:password" standard basic authentication in the URL?

Regarding the "token" field, this seems to be a non standard header. You can already add custom headers to an URL SCM. This should even work through scmOverride...

unluckely it doesn't work like expected. i switched this PR to fix the remaining issue.