fix: redact credentials in the wire logger and widen the field set

[jrosskopf]

Three credential-leak paths in DEBUG tracing, found by a final review and verified against a live Microsoft OAuth2 token exchange.

The leaks

1. The httplib completion logger printed the request body verbatim — and that is exactly the path an OAuth2 token POST takes, so client_secret went straight into the trace, bypassing RedactBody entirely.
2. The response preview had the same problem in the other direction: a token endpoint's response carries access_token and refresh_token.
3. RedactBody bailed out of a JSON value with no closing quote. Trace bodies are truncated before they reach it, so the cut regularly lands mid-token — and the visible prefix of an access_token was then printed verbatim. This one only appeared after the truncate-before-redact change made for performance, which is a good argument for testing redaction against real traffic rather than a synthetic body.

Also widened the credential set with id_token, client_assertion, code and code_verifier: a signed assertion, and an authorization code with its verifier, are as exchangeable as a secret.

Verified live

A real client-credentials flow against a Microsoft tenant with erpl_trace_level='DEBUG':

checked for	occurrences
the client secret's literal value	0
"access_token":"<jwt>"	0
Bearer <jwt> in headers	0
query still returned its row	yes

Before the fix the same run leaked the access token twice.

Refs DataZooDE/erpl-web#100.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}