Harden embedded secret redaction

[codeforester]

Summary

• fix generic inline redaction so every recognized key=value segment is scanned
• redact recognized secrets in header-style key: value segments without hiding adjacent non-secret values
• add regression coverage for query strings, comma-separated values, and HTTP headers
• document the expanded security control and include the fix in the unreleased changelog

Closes #211.

Validation

• UV_CACHE_DIR=/private/tmp/base-cli-uv-cache uv run --extra dev --extra quality pytest
• UV_CACHE_DIR=/private/tmp/base-cli-uv-cache uv run --extra quality ruff format --check lib/python/base_cli/redaction.py tests/test_redaction_security.py
• UV_CACHE_DIR=/private/tmp/base-cli-uv-cache uv run --extra quality ruff check lib/python/base_cli/redaction.py tests/test_redaction_security.py
• UV_CACHE_DIR=/private/tmp/base-cli-uv-cache uv run --extra quality mypy lib/python/base_cli/redaction.py
• ./tests/validate.sh