[internal] WebSocket telemetry exposes query-string credentials

[gsmlg]

Requesting repo: gsmlg-dev/gsmlg_umbrella on branch codex/remote-browser-control

What is needed and why

Commander authenticates every WebSocket open/reconnect with freshly generated values in the connection query:

• credential_id
• name
• sign_at
• nonce
• signature

HTTP.WebSocket.Telemetry currently places the original %URI{} in metadata.url for connect, message, and close events. Because the URI is not redacted, any telemetry handler or log exporter that serializes metadata.url persists the complete WebSocket URI, including the Commander HMAC signature and its associated authentication material.

Minimal reproduction

event = [:http_web_socket, :connect, :start]
handler_id = {:websocket_uri_leak, make_ref()}

:ok =
  :telemetry.attach(
    handler_id,
    event,
    fn _event, _measurements, metadata, owner ->
      send(owner, metadata)
    end,
    self()
  )

uri =
  URI.parse(
    "wss://commander.example/socket/websocket?credential_id=node-a-credential&name=node-a&sign_at=1788494400&nonce=nonce-value&signature=hmac-value"
  )

:ok = HTTP.WebSocket.Telemetry.connect_start(uri)

receive do
  metadata -> IO.puts(URI.to_string(metadata.url))
end

Observed output contains the entire query, including signature=hmac-value, nonce, sign_at, name, and credential_id.

Expected behavior

Telemetry should never emit URL credentials. At minimum, redact query and userinfo from metadata.url at the emission boundary for every WebSocket lifecycle and message event, while retaining safe fields such as scheme, host, port, and path.

A per-open handshake-header provider would also let callers keep freshly rotated reconnect credentials out of the URL. Until per-open credentials can be supplied as headers throughout the transport stack, URL redaction in HTTP.WebSocket.Telemetry is required as defense in depth.

Severity: needed