use ruby URI module to parse source origin

Fixes pinning when the repo location includes credentials.
spec for pinning a source with credentials
escape more braces properly

Fixes a couple of rspec regex warnings.
install required packages before changing sources.list

If we add an https repository then apt-transport-https should be a
required package. However, its installation fails if it happens after
writing sources.list but before updating package lists.