fix(security): redact clear-text logging of sensitive information

[scottschreckengaust]

Potential fix for https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/security/code-scanning/24

Best fix: harden _debug_cw so it never logs raw free-form text; instead, apply stronger sanitization that masks known secret values and secret-like key/value patterns before printing or shipping to CloudWatch.

Concretely in agent/src/server.py:

• Add import re.
• Replace _redact_cached_credentials implementation with a stronger sanitizer that:
  1. Redacts cached env secret values (GITHUB_TOKEN, LINEAR_API_TOKEN) when present.
  2. Redacts common secret assignment patterns in text (e.g., github_token=..., authorization: Bearer ..., secret=..., token=..., api_key=..., password=...) using regex.
• Keep behavior unchanged otherwise (same function name and call sites), so logging still works but sensitive values are masked.

No functional flow changes are required; only log content sanitization is strengthened.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[krokoko]

Closing since fixed in #81