fix(security): redact credentials from debug log output

[martinraumann]

nvbug 6025253

Summary

• `_req()` logged full request/response bodies at `debug` level with no redaction. With `RUST_LOG=libredfish=debug` enabled, plaintext passwords were emitted to any log aggregation pipeline (Splunk, ELK, Kubernetes pod logs, etc.)
• Add `redact_sensitive_fields()` — applies a once-compiled static regex before the body reaches `debug!()`, replacing credential values with `[REDACTED]` while preserving key names and all non-sensitive fields
• Fix response log sites to redact before truncating — truncating first could split a value string before its closing `"`, breaking the regex match and leaking a password prefix

Fields redacted

Key	Operation
`Password`	`create_user`, `change_password`, `change_password_by_id`
`OldPassword`, `NewPassword`	`change_bios_password`, HPE UEFI password ops
`CurrentUefiPassword`, `UefiPassword`	NVIDIA DPU `Bios/Settings` PATCH
`ImportBuffer`	Dell `ImportSystemConfiguration` fallback (XML blob containing `OldSetupPassword`)

Design notes

• Wire payload is never modified — only the string passed to `debug!()` is affected
• Zero-cost fast path — `Cow::Borrowed` returned unchanged when no sensitive key is present (two `str::contains` checks, no regex)
• Static regex — compiled once via `OnceLock`, not on every request

Test plan

• `cargo test network::tests` — 10 unit tests covering each redacted field, the fast path, wire-payload immutability, escaped characters, and the truncation-ordering fix
• `cargo test` — full suite passes (12 integration tests)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.