fix(validators): allow GitLab repository URLs with nested subgroups

[anneheartrecord]

Fixes #1359

Problem

gitlabURLRegex in internal/validators/utils.go only accepts exactly two path segments (owner/repo), so valid GitLab repository URLs using nested groups/subgroups (e.g. https://gitlab.com/myorg/team/subgroup/my-mcp-server) are rejected with invalid repository URL. Subgroups are a standard GitLab feature, and this blocks publishing servers whose source lives in a GitLab group hierarchy.

Fix

Change the regex from ^https?://(www\.)?gitlab\.com/[\w.-]+/[\w.-]+/?$ to ^https?://(www\.)?gitlab\.com/[\w.-]+(/[\w.-]+)+/?$.

Note this is slightly stricter than the [\w./-]+ variant suggested in the issue: it validates segment-by-segment, so URLs with empty path segments (gitlab.com/group//repo) stay rejected. The GitHub regex is unchanged (GitHub has no subgroups).

Testing

• Added internal/validators/utils_test.go with table-driven cases for IsValidRepositoryURL: nested/deeply-nested subgroup URLs now pass; flat owner/repo, trailing slash, and www. cases keep passing; malformed URLs (empty segments, spaces, spoofed hosts, query strings, fragments, missing repo) stay rejected; GitHub behavior unchanged.
• Added an end-to-end ValidateServerJSON case with a GitLab subgroup repository URL.
• go test ./internal/validators/... green; gofmt/go vet clean; golangci-lint introduces no new issues.

[anneheartrecord]

For reviewers — small, contained fix:

Bug: gitlabURLRegex hard-codes exactly two path segments (owner/repo), so GitLab nested subgroups (gitlab.com/org/team/sub/repo) are rejected — blocks self-hosted registries whose source lives in a group hierarchy.

Fix: one regex, [\w.-]+/[\w.-]+ → [\w.-]+(/[\w.-]+)+.

Note vs the issue's suggestion: the issue proposed [\w./-]+, but putting / inside the char class would also accept empty segments (group//repo). The segment-by-segment form here stays strict on that. GitHub regex untouched (no subgroups there).

23 table-driven cases (nested + deeply-nested pass; flat/trailing-slash/www. still pass; empty-segment/spaces/spoofed-host/query/fragment still rejected) + an e2e ValidateServerJSON case. go test ./internal/validators/... green, gofmt/vet clean, no new golangci-lint findings.