BinkP auth logging: keep DEBUG diagnostics, put secret material behind an explicit opt-in

[SkrawlCO]

TITLE: BinkP auth logging: keep DEBUG diagnostics, put secret material behind an explicit opt-in

This revisits the concern from #458 with a different design. #458 removed the authentication detail outright. Its review pointed out that the detail is valuable when debugging authentication with a peer, and asked for it to remain available, "at least with a flag to enable". This PR keeps DEBUG useful by default and adds that flag for the secret-derived parts.

Problem

At DEBUG level, BinkpSession logs:

• the first three characters of both the received and the expected (configured) plaintext password;
• the CRAM-MD5 challenge together with the computed HMAC digest. Logged as a pair, these allow an offline dictionary attack on the shared session password.

DEBUG is the level operators enable, and then share logs from, when an uplink's authentication fails.

Impact

Partial session secrets, and material for brute-forcing the full secret, end up in DEBUG logs and in the copies of them that get passed around.

Repair

• Default (no new setting): DEBUG still shows the authentication path and outcome, received and expected password lengths, the challenge length, and, on a plaintext mismatch, a non-secret hint: length differs, differs only by letter case, differs only by leading/trailing whitespace, or same length, content differs. No password characters and no challenge or digest values are written.
• BINKP_LOG_SENSITIVE_AUTH=true (default false): restores the previous detail: password prefixes, the full CRAM challenge, and the digest. While enabled, each session logs once at WARNING that secret material is being written to the log.
• Documented in docs/CONFIGURATION.md and .env.example.

Authentication behavior itself is unchanged.

Proof

tests/Unit/BinkpSensitiveAuthLoggingTest.php (no network, no database; config and logger stubs) covers:

• default plaintext: no password characters; the case-only, whitespace, length and content mismatch hints appear;
• default CRAM: no challenge and no digest in the log, lengths present;
• opt-in: prefixes, challenge and digest appear, and exactly one [WARNING] BINKP_LOG_SENSITIVE_AUTH is enabled per session;
• false, 0, no and empty values keep the safe default.

Fails on the current branch (5 failures); passes with the change. The rest of tests/Unit is unchanged.