Log OAuth requests and responses

[hughns]

The OAuth 2.0 flows in src/oauth/ called fetch directly, so none of the requests to the identity provider's registration, device authorization, token or revocation endpoints showed up in the logs. That makes debugging login and token refresh problems noticeably harder than debugging Client-Server API calls, which FetchHttpApi logs.

This adds a fetchWithLogging wrapper that emits the same --> / <-- debug lines as FetchHttpApi, and uses it for every OAuth 2.0 request:

OAuth2: --> POST https://auth.org/token
OAuth2: <-- POST https://auth.org/token [42ms 200]

As in FetchHttpApi, neither the request nor the response body is logged, and query parameter values are redacted — these requests routinely carry credentials. sanitizeUrlForLogs has been lifted out of FetchHttpApi into src/http-api/logging.ts so both can share it, with no change in behaviour.

OAuth2, OAuth2.registerClient, startDeviceAuthorization and waitForDeviceAuthorization now accept an optional Logger so callers can route these lines to the logger of their choice (e.g. a MatrixClient's logger). All of them default to the js-sdk root logger, so this is backwards compatible.

Checklist

• Tests written for new code (and old code if feasible).
• New or updated public/exported symbols have accurate TSDoc documentation.
• Linter and other CI checks pass.
• Sign-off given on the changes (see CONTRIBUTING.md).

🤖 Generated with Claude Code (with review by human)

[hughns]

Please let me know if there is a preferred way to wire up the logger.