[codex] log only configured XFCC header

[winhowes]

Summary

• Restrict envoy_xfcc auth failure logs to the configured XFCC header values instead of cloning the full request header map.
• Keep reason and configured_header in the structured log payload.
• Update the existing XFCC logging test to assert unrelated request headers are omitted.

Impact

Auth failure diagnostics still include the XFCC evidence needed for debugging, but unrelated headers such as tokens, cookies, or debug headers are not logged by this plugin failure path.

Validation

• go test ./app/auth ./app/auth/plugins/envoy_xfcc -coverprofile=/tmp/xfcc-only.cover
  • total: 100.0% statements
• go test ./app/auth ./app/auth/plugins/envoy_xfcc -count=5
• go test ./... -run '^$' -count=1
• git diff --check