fix(security): never expose credentials via the request observer or test report

Security review findings on the reporting feature, all addressed:

- AuthInterceptor: the RequestObserver now receives a defensive request copy
  with authtoken/authorization/access_token headers masked - the production
  seam can no longer hand out credentials even if abused
- TestReporter: request cURL bodies and response bodies are passed through
  redactSecrets() before entering the report - passwords, session authtokens,
  management/delivery token values (cs*), OAuth and TOTP secrets are replaced
  with ***REDACTED***. The report ships as a CI artifact, so no live secret
  may survive into it (previously the login cURL contained the account
  password and token-creation responses contained live token values)

Verified: suite 252/0 failures; regenerated report scan shows zero authtoken
values, zero cs* tokens, zero password strings (23 redaction markers). The
one session token exposed in a local report was invalidated via logout.

Author: aniket-shikhare-cstk

src/main/java/com/contentstack/cms/core/AuthInterceptor.java

@@ -103,14 +103,30 @@ public Response intercept(Chain chain) throws IOException {
         RequestObserver localObserver = observer;
         if (localObserver != null) {
             try {
-                localObserver.onCall(finalRequest, response, System.currentTimeMillis() - startedAt);
+                // Never hand credentials to observers: sensitive headers are
+                // masked on a defensive copy before the callback sees it.
+                localObserver.onCall(maskSensitiveHeaders(finalRequest), response,
+                        System.currentTimeMillis() - startedAt);
             } catch (Exception ignored) {
                 // observers must never break real requests
             }
         }
         return response;
     }
 
+    private static Request maskSensitiveHeaders(Request request) {
+        Request.Builder masked = request.newBuilder();
+        for (String name : new String[]{"authtoken", "authorization", "access_token"}) {
+            String value = request.header(name);
+            if (value != null) {
+                masked.header(name, value.length() > 12
+                        ? value.substring(0, 6) + "..." + value.substring(value.length() - 4)
+                        : "***");
+            }
+        }
+        return masked.build();
+    }
+
     /**
      * Observer for outgoing requests/responses. Intended for test harnesses
      * and diagnostics (e.g. capturing cURL commands for test reports);

src/test/java/com/contentstack/cms/TestReporter.java

@@ -107,6 +107,7 @@ private static void captureCall(Request request, Response response, long duratio
             call.sdkMethod = detectSdkMethod(request.method(), request.url().encodedPath());
             try {
                 String body = response.peekBody(MAX_BODY_CHARS + 1).string();
+                body = redactSecrets(body);
                 call.responseBody = body.length() > MAX_BODY_CHARS
                         ? body.substring(0, MAX_BODY_CHARS) + "\n... (truncated)" : body;
             } catch (Exception e) {
@@ -132,7 +133,7 @@ private static String toCurl(Request request) {
                 if (len > 0 && len < 65536) {
                     Buffer buffer = new Buffer();
                     request.body().writeTo(buffer);
-                    String body = buffer.readString(StandardCharsets.UTF_8).replace("'", "'\\''");
+                    String body = redactSecrets(buffer.readString(StandardCharsets.UTF_8)).replace("'", "'\\''");
                     curl.append(" \\\n  -d '").append(body).append("'");
                 }
             } catch (Exception ignored) {
@@ -142,6 +143,27 @@ private static String toCurl(Request request) {
         return curl.toString();
     }
 
+    /**
+     * Redacts credential values from JSON payloads before they enter the report:
+     * passwords, auth/session tokens, management/delivery token values, OAuth
+     * secrets and TOTP secrets. The report is shipped as a CI artifact, so no
+     * live secret may survive into it.
+     */
+    private static final Pattern SECRET_JSON_FIELDS = Pattern.compile(
+            "(\"(?:password|authtoken|token|management_token|secret|mfaSecret|tfaToken|tfa_token|"
+                    + "access_token|refresh_token|client_secret|api_secret)\"\\s*:\\s*\")([^\"]*)(\")",
+            Pattern.CASE_INSENSITIVE);
+    private static final Pattern CS_TOKEN_PATTERN = Pattern.compile("\\bcs[a-f0-9]{16,}\\b");
+
+    static String redactSecrets(String text) {
+        if (text == null || text.isEmpty()) {
+            return text;
+        }
+        String redacted = SECRET_JSON_FIELDS.matcher(text).replaceAll("$1***REDACTED***$3");
+        redacted = CS_TOKEN_PATTERN.matcher(redacted).replaceAll("cs***REDACTED***");
+        return redacted;
+    }
+
     private static String mask(String headerName, String value) {
         String lower = headerName.toLowerCase();
         if ((lower.equals("authtoken") || lower.equals("authorization") || lower.equals("access_token"))