security: prevent sensitive credentials from leaking into logs #6720

Some logs and error messages may expose credentials through URIs, configuration values, HTTP payloads, or wrapped errors.

Mask passwords, tokens, access keys, private credentials, and encryption key material while preserving non-sensitive diagnostic information such as IDs, status codes, payload sizes, endpoints, and underlying error causes. Redaction should be limited to confirmed sensitive fields to avoid making troubleshooting unnecessarily difficult.