feat: add injectable LoggerSanitizer to mask sensitive data in logs

[ndoschek]

What it does

Introduce LoggerSanitizer service that automatically masks credentials in log messages to prevent sensitive data leakage (e.g., proxy URLs with username:password, api keys).

• Add LoggerSanitizer interface and DefaultLoggerSanitizer implementation
• Integrate sanitizer into Logger.format()
• Provide a base set of sanitization rules to mask any URL protocol with credentials, api keys and authtokens
• Make sanitizer injectable and optional
• Add unit test cases

How to test

• add a proxy env variable either on cli or via the launch config, e.g. "HTTP_PROXY": "http://myusername:[email protected]:8080"
• start an example application with loglevel debug (e.g. via npm run start:debug or via the launch configs)
  • for additional test cases open the user settings file, close the applicaiton and inspect the 'fireDidChangeContent' logs on startup (contains api keys/authtokens if stored in user settings)
• optional: add "--log-file=example.log" to make log inspection easier
• verify that the url containing the logged credentials/api keys/auth tokens have been masked, e.g. "HTTP_PROXY": "http://****:****@proxy.example.com:8080"

Follow-ups

Breaking changes

• This PR introduces breaking changes and requires careful review. If yes, the breaking changes section in the changelog has been updated.

Attribution

Contributed on behalf of STMicroelectronics

Review checklist

• As an author, I have thoroughly tested my changes and carefully followed the review guidelines
• User-facing text is internationalized using the nls service (for details, please see the Internationalization/Localization section in the Coding Guidelines)

Reminder for reviewers

• As a reviewer, I agree to behave in accordance with the review guidelines