fix(security): redact OIDC secrets from logs and errors (#5147)

Stop the OIDC subsystem from writing credential-grade secrets into logs and returned errors.

- crates/iam/src/oidc.rs: redact sensitive header values (authorization, proxy-authorization, cookie, set-cookie) in format_http_headers, emitting only name and length; drop the raw request/response body from the DEBUG events (keep byte length); stop logging and stop splicing the raw token response body into the error returned on token_response_parse_failed (the TokenResponseBodyShape summary and length are retained); remove the now-unused format_http_body helper.
- rustfs/src/admin/handlers/oidc.rs: stop logging the raw authorization code and state on the code-exchange error path (code_len/state_len are kept).

This is the OIDC log/error redaction pre-work (batch 0B) from the OIDC review in rustfs/backlog#1437. It changes diagnostic content only; HTTP/STS status codes and legitimate request results are unchanged.

rustfs/src/admin/handlers/oidc.rs

@@ -593,8 +593,6 @@ impl Operation for OidcCallbackHandler {
                         result = "code_exchange_failed",
                         requested_provider_id = %provider_id,
                         redirect_uri = %redirect_uri,
-                        code = %code,
-                        state = %state,
                         code_len = code.len(),
                         state_len = state.len(),
                         error = %message,