fix: redact Bolt authentication values from logs

[hari2353]

Summary

Redact authentication-bearing values before Bolt protocol fields are written to logs.

Bolt HELLO, LOGON, and other message diagnostics currently serialize JSON fields directly. Authentication credentials can therefore appear in logs at info or debug level. This change keeps safe protocol metadata visible while replacing sensitive values with <redacted>.

Changes

• Added recursive redaction for JSON objects and arrays.
• Redacts exact sensitive keys and underscore/hyphen-separated components including password, credentials, secret, token, authorization, and auth.
• Preserves non-sensitive values such as principal, author, and database.
• Keeps PackStream logging limited to its byte length.
• Added unit tests for nested objects, arrays, safe metadata, and PackStream summaries.

Security impact

This prevents authentication material from being emitted through the shared bolt_value_to_string logging path. It does not change Bolt protocol behavior, authentication configuration, or query execution.

Verification

Verified in the repository's CI-matched Rust 1.92 Linux container:

cargo fmt --all -- --check
cargo test --locked redacts_sensitive_bolt_log_values_recursively --lib
cargo test --locked preserves_safe_packstream_log_summary --lib
cargo check --locked --all-targets
cargo clippy --locked --all-targets -- -D warnings

All commands passed.

The Windows full suite also ran locally. Existing corpus and SQL-golden failures were confirmed to be CRLF/LF-only mismatches in the Windows checkout; no semantic SQL differences were found. Those unrelated baseline issues are not included in this PR.