Redact credentials from server.log

[average-enjoyer]

Problem

run_curl() in main.py writes the full curl command line to server.log before executing it:

[gerrit-mcp-server] Executing: curl --user :<auth_token> -L https://...

For the http_basic auth method, this puts the raw HTTP Basic Auth token in plaintext in a log file on disk on every single request. The gitcookies auth method has the same problem — the session cookie passed via -b <cookie> ends up in the log the same way.

Fix

Mask the credential-bearing arguments before writing the log line. The actual curl invocation is unchanged — only what gets written to server.log is redacted. --user user:token becomes --user user:***REDACTED***, and -b <cookie> becomes
-b ***REDACTED***.

Testing

Ran the server locally with http_basic auth configured, made a real authenticated call against a Gerrit instance get_change_details), and confirmed: - the request still succeeds (auth unaffected) - server.log now shows --user <username>:***REDACTED*** instead of the plaintext token

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[average-enjoyer]

@googlebot I signed it!

[average-enjoyer]

@googlebot I signed it!