refactor(sts): consolidate exchange logging into one outcome log

[hibare]

Summary

Consolidate exchange logging into a single deferred Service.logExchange that emits one structured line per request — INFO on success, WARN on denial, ERROR on internal failures — with full caller, policy, and token context on every path.

Changes

• Replace per-layer authorizer logs and per-step INFO breadcrumbs with one outcome log on Service.Exchange. Reads only from the response and *ExchangeError; no progress state inside Exchange.
• Authorizer drops its logger field, logResult method, and *slog.Logger constructor arg — it's now a pure decision engine.
• ExchangeResponse gains ClientID, TokenHash, TTL tagged json:"-" (consistent with existing Issuer/Subject) so internal observers read full context without affecting API consumers.
• DEBUG-level oidc validated and github app selected breadcrumbs kept for triage.

Example output

Granted

INFO token exchange granted request_id=abc repository=owner/repo issuer=... subject=... policy=default client_id=Iv1.xxx token_hash=... ttl=900 expires_at=... permissions_count=2

Denied

WARN token exchange denied request_id=abc repository=owner/repo issuer=... subject=... code=POLICY_NOT_FOUND message="no matching policy" details=...

Internal failure

ERROR token exchange denied request_id=abc code=INTERNAL_ERROR message="Audit log failed" details=...

[arber-salihi]

Looks good to me.