fix(supervisor-network): redact FORWARD query strings in OCSF and denials

[Ayush7614]

Summary

Harden FORWARD HTTP proxy emit sites so query-string secrets never land in on-disk OCSF/shorthand logs or client-facing 403 bodies. Read-path denial redaction remains as defense-in-depth.

Related Issue

N/A — direct fix for a documented emit-site gap (previously only mitigated on the agent-facing denial read path). No open/closed/merged issue or PR covered this.

Changes

• Add redact_path_for_logging / redact_uri_for_logging helpers (?[redacted] marker)
• Apply redaction across FORWARD OCSF URL fields, messages, parse errors, and 403 detail bodies
• Redact URIs inside parse_proxy_uri error messages so secrets cannot leak via {e}
• Update policy_local comment to reflect emit-site hardening
• Document the invariant in architecture/security-policy.md
• Add unit tests covering path/URI redaction, parse-error hygiene, and OCSF URL display

Testing

• mise run pre-commit passes (mise not available in this environment; cargo fmt --check clean for touched crate)
• Unit tests added/updated (cargo test -p openshell-supervisor-network --lib for redact_*, parse_proxy_uri_errors_do_not_embed_query_secrets, ocsf_url_from_redacted_path_keeps_marker_not_secret, and existing test_parse_proxy_uri*)
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Thank you for your interest in contributing to OpenShell, @Ayush7614.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

1. Open a Vouch Request discussion.
2. Describe what you want to change and why.
3. Write in your own words — do not have an AI generate the request.
4. A maintainer will comment /vouch if approved.
5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.

[github-actions]

Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text:

---

I have read the DCO document and I hereby sign the DCO.

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot.}

[johntmyers]

This should largely be covered by #2510