fix(security): fingerprint Basic-Auth principal in request log (CodeQL go/clear-text-logging)

[szibis]

What

Routes the Basic-Auth username (auth.principal in the structured request log) through the existing redactQuery fingerprint (sha256:<8hex> len=<n>) instead of logging it verbatim. Verbatim output remains available under -debug-log-raw-queries=true.

Why

CodeQL HIGH go/clear-text-logging at internal/proxy/query_translation.go:231: the Basic-Auth username — credential material read from the Authorization header via r.BasicAuth() — flowed verbatim into the audit log. The password was never logged.

The fix mirrors the repo's established redaction idiom (redactQuery, gated by -debug-log-raw-queries). Trusted-proxy enduser.* audit-identity fields (from X-Grafana-User etc.) are intentionally unchanged — those are already-authenticated identities used for audit, not credential material.

Verification

• New TestRequestLogger_RedactsBasicAuthPrincipal: asserts the username is fingerprinted by default, emitted verbatim under the debug flag, and the password never appears in the log. ✅
• Full internal/proxy package: 2323 passed ✅

Part of a stacked series addressing the failing Security workflow and open code-scanning/Dependabot alerts.

[github-actions]

PR Quality Report

Compared against base branch main.

Coverage and tests

Signal	Base	PR	Delta
Test count	4792	4793	1
Coverage	85.1%	85.0%	-0.1% (stable)

Compatibility

Track	Base	PR	Delta
Loki API	100.0%	11/11 (100.0%)	0.0% (stable)
Logs Drilldown	100.0%	17/17 (100.0%)	0.0% (stable)
VictoriaLogs	100.0%	11/11 (100.0%)	0.0% (stable)

Performance smoke

Lower CPU cost (ns/op) is better. Lower benchmark memory cost (B/op, allocs/op) is better. Higher throughput is better. Lower load-test memory growth is better. Benchmark rows are medians from repeated samples.

Signal	Base	PR	Delta
QueryRange cache-hit CPU cost	3091.0 ns/op	3096.0 ns/op	+0.2% (stable)
QueryRange cache-hit memory	1184.0 B/op	1184.0 B/op	0.0% (stable)
QueryRange cache-hit allocations	29.0 allocs/op	29.0 allocs/op	0.0% (stable)
QueryRange cache-bypass CPU cost	3342.0 ns/op	3379.0 ns/op	+1.1% (stable)
QueryRange cache-bypass memory	1245.0 B/op	1245.0 B/op	0.0% (stable)
QueryRange cache-bypass allocations	30.0 allocs/op	30.0 allocs/op	0.0% (stable)
Labels cache-hit CPU cost	710.5 ns/op	722.6 ns/op	+1.7% (stable)
Labels cache-hit memory	48.0 B/op	48.0 B/op	0.0% (stable)
Labels cache-hit allocations	3.0 allocs/op	3.0 allocs/op	0.0% (stable)
Labels cache-bypass CPU cost	1285.0 ns/op	1282.0 ns/op	-0.2% (stable)
Labels cache-bypass memory	391.0 B/op	391.0 B/op	0.0% (stable)
Labels cache-bypass allocations	14.0 allocs/op	14.0 allocs/op	0.0% (stable)

State

• Coverage, compatibility, and sampled performance are reported here from the same PR workflow.
• This is a delta report, not a release gate by itself. Required checks still decide merge safety.
• Performance is a smoke comparison, not a full benchmark lab run.
• Delta states use the same noise guards as the quality gate (percent + absolute + low-baseline checks), so report labels match merge-gate behavior.