Redact Authorization header from signJWT debug logs

[diegoDrp-Dev]

Prevents the access token used by signJWT() from being included in debug logging.

The request continues to use the original Authorization header, while a sanitized copy of the headers is passed to the logger.

This also adds a regression test verifying that:

• the real bearer token is sent to the HTTP client;
• the token is not passed to the logger;
• the logged Authorization header is redacted;
• signJWT() behavior remains unchanged.

Related Google Issue Tracker report: 550959018

Validation:

• npm test: 55/55 passing
• npm run lint: passing
• npm run build: passing
• git diff --check: passing

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.