fix(httpdump): redact sensitive headers in request and response dumps

[fallintoplace]

Why

HTTP dumps produced for API errors and debug logging could include sensitive header values. That could expose bearer tokens, API keys, organization and project identifiers, webhook signatures, or cookie values in logs.

What changed

• Add one case-insensitive redaction helper for sensitive headers.
• Apply it to API error request/response dumps and option debug logging.
• Restore the original header maps after dumping so live requests and responses are not mutated.
• Add coverage for sensitive and non-sensitive headers, including manually constructed non-canonical header names.

Validation

• go test ./internal/apierror ./internal/httpdump ./option