fix(cli): show clean error instead of panic for invalid --unsafely-ignore-certificate-errors value (#32868)
## Summary
- Fixes a panic when a URL (e.g. `https://example.com/`) is passed to
`--unsafely-ignore-certificate-errors`, which only accepts domains and
IPs.
- Changed `unsafely_ignore_certificate_errors_parse` to return
`clap::error::Result<()>` and propagate the validation error instead of
`.unwrap()`-ing it.
- Updated all three call sites and `upgrade_parse` to propagate the
error.
Fixes #30513
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>