Keep credentials out of app-server logs (#39993)

## Why

App-server logs can be persisted or included in submitted diagnostics, so credentials used by model providers, authentication refreshes, and attestation requests must not appear in diagnostic output.

## What changed

- Add `RedactedString`, which preserves serialization and string access while replacing debug output with `<redacted>`.
- Use it for model-provider bearer tokens, header and query values, authentication command arguments, and attestation tokens.
- Avoid logging JSON-RPC error payloads and parser or authentication errors that may echo credentials; retain safe context such as error codes and categories.

## Testing

- Add an app-server regression test that exercises provider credentials, refreshed authentication tokens, and attestation tokens, then verifies none appear in persisted SQLite or submitted diagnostic logs.

GitOrigin-RevId: 8c50408adf94d93847658b1320682cf3b637d2cc

codex-rs/model-provider/src/models_endpoint.rs

@@ -413,7 +413,7 @@ mod tests {
         let mut provider_info = ModelProviderInfo::create_openai_provider(Some(server.uri()));
         provider_info.http_headers = Some(std::collections::HashMap::from([(
             RESIDENCY_HEADER_NAME.to_string(),
-            "eu".to_string(),
+            "eu".into(),
         )]));
         let endpoint = OpenAiModelsEndpoint {
             provider_info,
@@ -438,9 +438,8 @@ mod tests {
                 .provider_info
                 .http_headers
                 .as_ref()
-                .and_then(|headers| headers.get(RESIDENCY_HEADER_NAME))
-                .map(String::as_str),
-            Some("eu")
+                .and_then(|headers| headers.get(RESIDENCY_HEADER_NAME)),
+            Some(&"eu".into())
         );
     }
 }