feat(security): add global tracing scrubber to prevent token exposure in logs

[alessandrostone]

Summary

• Implements comprehensive token sanitization using tracing-subscriber
• Prevents GitHub installation tokens from leaking through git error messages
• Automatically redacts all sensitive data across the entire application

Changes

• New module: src/tracing_sanitizer.rs with regex-based sanitization
  • Detects and redacts GitHub tokens (ghp_, gho_, ghu_, ghs_, ghr_)
  • Sanitizes credentials in URLs (x-access-token, basic auth, Bearer tokens)
  • Implements MakeWriter trait for automatic log interception
• Added tracing instrumentation to gitops.rs and app_auth.rs
• Fixed async safety: Switched from std::sync::Mutex to tokio::sync::Mutex
• Public API: Exposed init_tracing() and init_tracing_json() functions

Security Impact

🔒 Resolves critical vulnerability: Installation tokens embedded in git clone URLs (e.g., https://x-access-token:TOKEN@github.com/repo.git) were previously exposed in error messages when git commands failed. All tokens are now automatically redacted before logs are written.

Test Coverage

• ✅ 18/18 tests passing (11 sanitizer + 4 integration + 3 doc tests)
• ✅ 0 clippy warnings (with -D warnings enabled)
• ✅ Comprehensive test suite covering all token types and edge cases

Example Output

Before: Error: git clone failed: https://x-access-token:ghs_16C7e42F292c6912E7710c838347Ae178B4a@github.com/repo.git

After: Error: git clone failed: https://x-access-token:[REDACTED]@github.com/repo.git