Keep credentials out of app-server logs (#39993)

## Why

App-server logs can be persisted or included in submitted diagnostics, so credentials used by model providers, authentication refreshes, and attestation requests must not appear in diagnostic output.

## What changed

- Add `RedactedString`, which preserves serialization and string access while replacing debug output with `<redacted>`.
- Use it for model-provider bearer tokens, header and query values, authentication command arguments, and attestation tokens.
- Avoid logging JSON-RPC error payloads and parser or authentication errors that may echo credentials; retain safe context such as error codes and categories.

## Testing

- Add an app-server regression test that exercises provider credentials, refreshed authentication tokens, and attestation tokens, then verifies none appear in persisted SQLite or submitted diagnostic logs.

GitOrigin-RevId: 8c50408adf94d93847658b1320682cf3b637d2cc

codex-rs/app-server-protocol/src/protocol/v2/attestation.rs

@@ -1,5 +1,6 @@
 use crate::JsonSchema;
 use crate::TS;
+use codex_utils_redacted_string::RedactedString;
 use serde::Deserialize;
 use serde::Serialize;
 
@@ -13,5 +14,6 @@ pub struct AttestationGenerateParams {}
 #[ts(export_to = "v2/")]
 pub struct AttestationGenerateResponse {
     /// Opaque client attestation token.
-    pub token: String,
+    #[ts(type = "string")]
+    pub token: RedactedString,
 }