Mask credentials in debug output and config commands

[baiyuqing]

Problem

Debug mode (--debug / TICLOUD_DEBUG) dumped full HTTP requests and responses. The dump contained:

• the Authorization header (Bearer token, Digest metadata)
• OAuth access/refresh tokens and the OAuth client secret in auth login / auth logout bodies
• cloud storage access keys, service account keys and SAS tokens in import / export / audit-log request bodies
• pre-signed URL signatures and file content in the S3 uploader and export download paths

config describe printed private-key, oauth-client-secret and access-token (with --insecure-storage). config set echoed the value of private-key and oauth-client-secret.

Change

• New package internal/redact: one masking implementation for headers, JSON body fields, pre-signed URL query parameters and profile properties, plus a DebugTransport that prints masked dumps. Non-JSON bodies (uploads, downloads) are not read; only their size is printed.
• cloud.NewDebugTransport delegates to it (covers Bearer and Digest API clients).
• auth login/logout/whoami, the S3 uploader and the export download helper wrap their existing transport with it instead of calling resty SetDebug.
• config describe masks private-key, oauth-client-secret, access-token. public-key stays visible.
• config set prints *** for private-key and oauth-client-secret.
• Generated v1beta1 clients: the latent cfg.Debug dump passes body=false. Auth headers are added below that layer, so the remaining dump carries no credentials. This is a mechanical patch of generated files; a regeneration would revert it, but transport-level masking still applies.

Behavior notes

• Debug output for the three auth commands, uploader and download now goes to stdout through the shared transport instead of resty's stderr logger. Non-debug behavior is unchanged.
• --debug still prints method, URL, headers, status and JSON bodies, with only credential fields replaced by ***.

Tests

• Existing config describe/set and root_test.go expectations updated for the mask.
• New internal/redact/redact_test.go sends a request with a bearer token, cloud AKSK body, pre-signed URL parameters and a Set-Cookie response through the dumper and asserts none of them appear in the output while request and response bodies remain readable.
• go build ./..., go vet ./..., go test ./... pass.