Remove webhook log path (which contains sig signing secret) from logs, unless in debug mode - #844

Webhook/notification log paths could leak secrets:

- pkg/http auth middleware logged the Basic auth password at error
  level and the bearer token at warn level whenever a webhook request
  failed authentication.
- The teams, discord, webhook and mattermost notification senders
  logged the full configured endpoint URL at info level; these URLs
  embed the webhook signing secret in the path or query string.
- mattermost additionally logged the raw endpoint on the invalid-
  endpoint error path, and all four senders returned url.ParseRequestURI
  errors, which echo the input, back to the notification manager which
  logs them.

Changes:

- Add notification.SafeURL (safe at any level: scheme+host only) and
  notification.DebugURL (debug level only: path structure preserved,
  userinfo / token-like segments / query values redacted).
- Senders now log only the redacted endpoint at info level; the more
  detailed endpoint is logged only when debug logging is enabled, and
  is redacted there too.
- Auth middleware no longer logs passwords or tokens.
- Parse-error messages no longer echo the raw endpoint.

Audit of all log statements in the webhook trigger and notification
HTTP handler paths confirms no other statement logs request paths,
query strings, headers or payloads that can carry secrets: remaining
payload logs (jfrog, harbor, registry notifications) are debug-level
only.

Supersedes community PR keel-hq#844 (which redacted only the teams sender and
still logged the full URL in debug mode); keel-hq#844 is intentionally left
unmerged.

Tests: log-capture unit tests prove the secret does not appear in
captured log output when a webhook request is processed (both inbound
authenticated webhook endpoints and outbound sender configuration), at
info and debug levels.

Spec-Ref: helix-specs@dd566737:000395_security-fix-keep-the