fix: Extract redirect-URL credentials on 401 even with --no-input (#14182)

When an index issues a cross-origin 302 whose Location carries embedded
Basic-auth credentials, the vendored requests session strips the
Authorization header, so the upstream host returns 401. handle_401 is
meant to recover by reading the credentials still present in resp.url and
retrying, which needs no user interaction.

That recovery was gated behind use_keyring, which --no-input turns off for
the default keyring provider (prompting=False). As a result --no-input
silently disabled the non-interactive credential-from-URL extraction and
pip returned the 401 unretried.

Call _get_new_credentials() unconditionally and gate only the keyring
lookup on use_keyring. The following `not self.prompting` guard still
returns the 401 unchanged when no credentials are found without prompting.