cli/demo: sanitize the printing of connection URLs

Prior to this patch, the printing of connection URLs for secondary
tenant servers was too simplistic.

Acknowledging that tenant servers are just regular servers,
this commit uses the same code for both types of tenants.

Before:
```
   system tenant
     (webui)    http://127.0.0.1:8083/demologin?password=demo8336&username=demo
     (sql)      postgresql://demo:demo8336@127.0.0.1:26260/defaultdb?sslmode=require&sslrootcert=%2Ftmp%2Fdemo1374536428%2Fca.crt
     (sql/jdbc) jdbc:postgresql://127.0.0.1:26260/defaultdb?password=demo8336&sslmode=require&sslrootcert=%2Ftmp%2Fdemo1374536428%2Fca.crt&user=demo
     (sql/unix) postgresql://demo:demo8336@/defaultdb?host=%2Ftmp%2Fdemo1374536428&port=26260

   tenant 1:
      (sql):  postgresql://demo:demo8336@127.0.0.1:26257/movr?sslmode=require&sslrootcert=%2Ftmp%2Fdemo1374536428%2Fca-client-tenant.crt

   tenant 2:
      (sql):  postgresql://demo:demo8336@127.0.0.1:26258/movr?sslmode=require&sslrootcert=%2Ftmp%2Fdemo1374536428%2Fca-client-tenant.crt
...
```

After:
```
   system tenant
     (webui)    http://127.0.0.1:8083/demologin?password=demo36514&username=demo
     (sql)      postgresql://demo:demo36514@127.0.0.1:26260/defaultdb?sslmode=require&sslrootcert=%2Ftmp%2Fdemo1584871889%2Fca.crt
     (sql/jdbc) jdbc:postgresql://127.0.0.1:26260/defaultdb?password=demo36514&sslmode=require&sslrootcert=%2Ftmp%2Fdemo1584871889%2Fca.crt&user=demo
     (sql/unix) postgresql://demo:demo36514@/defaultdb?host=%2Ftmp%2Fdemo1584871889&port=26260

   tenant 1:
     (webui)    https://127.0.0.1:8080/demologin?password=demo36514&username=demo
     (sql)      postgresql://demo:demo36514@127.0.0.1:26257/movr?sslmode=require&sslrootcert=%2Ftmp%2Fdemo1584871889%2Fca-client-tenant.crt
     (sql/jdbc) jdbc:postgresql://127.0.0.1:26257/movr?password=demo36514&sslmode=require&sslrootcert=%2Ftmp%2Fdemo1584871889%2Fca-client-tenant.crt&user=demo

   tenant 2:
     (webui)    https://127.0.0.1:8081/demologin?password=demo36514&username=demo
     (sql)      postgresql://demo:demo36514@127.0.0.1:26258/movr?sslmode=require&sslrootcert=%2Ftmp%2Fdemo1584871889%2Fca-client-tenant.crt
     (sql/jdbc) jdbc:postgresql://127.0.0.1:26258/movr?password=demo36514&sslmode=require&sslrootcert=%2Ftmp%2Fdemo1584871889%2Fca-client-tenant.crt&user=demo
...
```

Release note: None

pkg/cli/democluster/demo_cluster.go

@@ -1460,44 +1460,39 @@ func (c *transientCluster) ListDemoNodes(w, ew io.Writer, justOne bool) {
 			// the demo.
 			fmt.Fprintf(w, "node %d:\n", nodeID)
 		}
-		serverURL := s.Cfg.AdminURL()
-		if !c.demoCtx.Insecure {
-			// Print node ID and web UI URL. Embed the autologin feature inside the URL.
-			// We avoid printing those when insecure, as the autologin path is not available
-			// in that case.
-			pwauth := url.Values{
-				"username": []string{c.adminUser.Normalized()},
-				"password": []string{c.adminPassword},
-			}
-			serverURL.Path = server.DemoLoginPath
-			serverURL.RawQuery = pwauth.Encode()
-		}
-		fmt.Fprintln(w, "  (webui)   ", serverURL)
-		// Print network URL if defined.
-		netURL, err := c.getNetworkURLForServer(context.Background(), i,
+		uiURL := s.Cfg.AdminURL()
+		sqlURL, err := c.getNetworkURLForServer(context.Background(), i,
 			false /* includeAppName */, false /* forSecondaryTenant */)
 		if err != nil {
 			fmt.Fprintln(ew, errors.Wrap(err, "retrieving network URL"))
 		} else {
-			fmt.Fprintln(w, "  (sql)     ", netURL.ToPQ())
-			fmt.Fprintln(w, "  (sql/jdbc)", netURL.ToJDBC())
-		}
-		// Print unix socket if defined.
-		if c.useSockets {
-			fmt.Fprintln(w, "  (sql/unix)", c.sockForServer(i))
+			c.printURLs(w, ew, sqlURL, uiURL, c.sockForServer(i))
 		}
 		fmt.Fprintln(w)
 	}
 	// Print the SQL address of each tenant if in MT mode.
 	if c.demoCtx.Multitenant {
 		for i := range c.servers {
 			fmt.Fprintf(w, "tenant %d:\n", i+1)
-			tenantURL, err := c.getNetworkURLForServer(context.Background(), i,
-				false /* includeAppName */, true /* forSecondaryTenant */)
+			uiURLstr := c.tenantServers[i].AdminURL()
+			uiURL, err := url.Parse(uiURLstr)
 			if err != nil {
 				fmt.Fprintln(ew, errors.Wrap(err, "retrieving tenant network URL"))
 			} else {
-				fmt.Fprintln(w, "   (sql): ", tenantURL.ToPQ())
+				sqlURL, err := c.getNetworkURLForServer(context.Background(), i,
+					false /* includeAppName */, true /* forSecondaryTenant */)
+				if err != nil {
+					fmt.Fprintln(ew, errors.Wrap(err, "retrieving tenant network URL"))
+				} else {
+					// The unix socket is currently not defined for secondary
+					// tenant servers.
+					//
+					// NB: it will become defined once we use a single SQL
+					// listener for all tenants; after which this code can be
+					// simplified.
+					socket := unixSocketDetails{}
+					c.printURLs(w, ew, sqlURL, uiURL, socket)
+				}
 			}
 			fmt.Fprintln(w)
 		}
@@ -1511,6 +1506,28 @@ func (c *transientCluster) ListDemoNodes(w, ew io.Writer, justOne bool) {
 	}
 }
 
+func (c *transientCluster) printURLs(
+	w, ew io.Writer, sqlURL *pgurl.URL, uiURL *url.URL, socket unixSocketDetails,
+) {
+	if !c.demoCtx.Insecure {
+		// Print node ID and web UI URL. Embed the autologin feature inside the URL.
+		// We avoid printing those when insecure, as the autologin path is not available
+		// in that case.
+		pwauth := url.Values{
+			"username": []string{c.adminUser.Normalized()},
+			"password": []string{c.adminPassword},
+		}
+		uiURL.Path = server.DemoLoginPath
+		uiURL.RawQuery = pwauth.Encode()
+	}
+	fmt.Fprintln(w, "  (webui)   ", uiURL)
+	fmt.Fprintln(w, "  (sql)     ", sqlURL.ToPQ())
+	fmt.Fprintln(w, "  (sql/jdbc)", sqlURL.ToJDBC())
+	if socket.exists() {
+		fmt.Fprintln(w, "  (sql/unix)", socket)
+	}
+}
+
 // genDemoPassword generates a password that prevents accidental
 // misuse of the DB console started by demo shells.
 // It also prevents beginner or naive programmers from scripting the