feat(log): truncate access tokens in debug logs by default

[synackd]

Description

Previously, enabling debug logging exposed access tokens in full at three points, leaking sensitive credentials into logs, terminal scrollback, and any captured output shared for troubleshooting:

• internal/cli/cli.go: the --token flag value was logged verbatim
• internal/cli/cli.go: the token read from the cluster's <CLUSTER>_ACCESS_TOKEN environment variable was logged verbatim
• pkg/client/client.go: the request "Authorization: Bearer " header was logged verbatim in the request-header debug loop

This change truncates any token that would appear in debug logs to its first 6 characters followed by an ellipsis (e.g. "eyJhbG..."). The logs still indicate that a token is present and hint at its identity, but no longer disclose the full, usable credential. A new --show-token flag restores the previous behavior of logging the full token for cases where an operator explicitly needs to inspect it.

The token-hiding behavior is on by default. To see the full token in logs, users must now pass --show-token.

Checklist

• My code follows the style guidelines of this project
• I have added/updated comments where needed
• I have added tests that prove my fix is effective or my feature works
• I have run make test (or equivalent) locally and all tests pass
• I have updated the relevant documentation (CLI examples, man pages, README, other docs, etc.)
• DCO Sign-off: All commits are signed off (git commit -s) with my real name and email
• REUSE Compliance:
  • Each new/modified source file has SPDX copyright and license headers
  • Any non-commentable files include a <filename>.license sidecar
  • All referenced licenses are present in the LICENSES/ directory

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Dependency update

---

For more info, see Contributing Guidelines.