fix: improves debug logging of HTTP requests (#150)

<!-- CURSOR_SUMMARY -->
> [!NOTE]
> **Low Risk**
> Low risk: changes are limited to debug logging and a new unit test,
with no impact on request execution or data parsing aside from log
formatting.
> 
> **Overview**
> **Prevents leaking SDK credentials in debug logs** by sanitizing the
polling request string before logging in `DefaultFeatureRequestor`
(redacts the `Authorization` header value and uses deferred log
evaluation).
> 
> Adds a regression test ensuring the "Making request" debug message
contains `REDACTED` and does not include the SDK key, while confirming
the actual HTTP request still sends the real `Authorization` header.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
3b786dc. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Author: tanderson-ld

lib/sdk/server/src/main/java/com/launchdarkly/sdk/server/DefaultFeatureRequestor.java

@@ -12,6 +12,7 @@
 import com.google.common.annotations.VisibleForTesting;
 import com.google.gson.stream.JsonReader;
 import com.launchdarkly.logging.LDLogger;
+import com.launchdarkly.logging.LogValues;
 import com.launchdarkly.sdk.internal.http.HttpConsts;
 import com.launchdarkly.sdk.internal.http.HttpErrors.HttpErrorException;
 import com.launchdarkly.sdk.internal.http.HttpHelpers;
@@ -32,6 +33,22 @@
 final class DefaultFeatureRequestor implements FeatureRequestor {
   private static final long MAX_HTTP_CACHE_SIZE_BYTES = 10 * 1024 * 1024; // 10 MB
 
+  private static final String REDACTED = "REDACTED";
+
+  private static String sanitizedRequestStringForLogging(Request request) {
+    Request.Builder builder = request.newBuilder();
+    redactHeaderValueForLog(builder, request, "Authorization");
+    return builder.build().toString();
+  }
+
+  private static void redactHeaderValueForLog(Request.Builder builder, Request request, String name) {
+    if (request.headers(name).isEmpty()) {
+      return;
+    }
+    builder.removeHeader(name);
+    builder.addHeader(name, REDACTED);
+  }
+
   private final OkHttpClient httpClient;
   @VisibleForTesting
   final URI pollingUri;
@@ -88,7 +105,7 @@ public FullDataSet<ItemDescriptor> getAllData(boolean returnDataEvenIfCached)
         .get()
         .build();
 
-    logger.debug("Making request: " + request);
+    logger.debug("Making request: {}", LogValues.defer(() -> sanitizedRequestStringForLogging(request)));
 
     try (Response response = httpClient.newCall(request).execute()) {
       boolean wasCached = response.networkResponse() == null || response.networkResponse().code() == 304;

lib/sdk/server/src/test/java/com/launchdarkly/sdk/server/DefaultFeatureRequestorTest.java

@@ -1,5 +1,7 @@
 package com.launchdarkly.sdk.server;
 
+import com.launchdarkly.logging.LDLogLevel;
+import com.launchdarkly.logging.LogCapture;
 import com.launchdarkly.sdk.internal.http.HttpErrors.HttpErrorException;
 import com.launchdarkly.sdk.internal.http.HttpProperties;
 import com.launchdarkly.sdk.server.DataModel.FeatureFlag;
@@ -27,7 +29,9 @@
 import static com.launchdarkly.sdk.server.TestComponents.clientContext;
 import static com.launchdarkly.sdk.server.TestUtil.assertDataSetEquals;
 import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsString;
 import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.not;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
@@ -244,4 +248,28 @@ private void verifyHeaders(RequestInfo req) {
       assertThat(req.getHeader(kv.getKey()), equalTo(kv.getValue()));
     }
   }
+
+  @Test
+  public void makingRequestDebugLogRedactsAuthorizationValue() throws Exception {
+    Handler resp = Handlers.bodyJson(allDataJson);
+    try (HttpServer server = HttpServer.start(resp)) {
+      try (DefaultFeatureRequestor r = makeRequestor(server)) {
+        r.getAllData(true);
+
+        String makingRequestLog = null;
+        for (LogCapture.Message m : logCapture.getMessages()) {
+          if (m.getLevel() == LDLogLevel.DEBUG && m.getText().contains("Making request:")) {
+            makingRequestLog = m.getText();
+            break;
+          }
+        }
+        assertNotNull("expected Making request debug log", makingRequestLog);
+        assertThat(makingRequestLog, containsString("REDACTED"));
+        assertThat(makingRequestLog, not(containsString(sdkKey)));
+
+        RequestInfo req = server.getRecorder().requireRequest();
+        assertEquals(sdkKey, req.getHeader("Authorization"));
+      }
+    }
+  }
 }