fix(transport): keep harmless query values visible in --debug output

--debug replaced every query value with REDACTED, so it could not show which
filters were sent. Redact only parameters that can authenticate a request
(tokens, passwords, secrets, signatures, storage credentials, OAuth codes and
the OAuth state), and log the sanitized server message of failed responses.

A 404 now names the request instead of blaming the instance, and API errors
recorded from a request keep its instance and credential so a caller can look
up why it failed. Network failures keep the server they could not reach.

Signed-off-by: bircni <bircni@icloud.com>

internal/transport/api_test.go

@@ -172,7 +172,12 @@ func TestCaptureErrorsSanitizesAndKeepsBodyReadable(t *testing.T) {
 			require.NoError(t, err)
 			require.NoError(t, resp.Body.Close())
 			require.Equal(t, tc.body, string(data))
-			require.Equal(t, &APIError{Status: tc.status, Method: http.MethodPatch, Endpoint: "/api/v1/repos/a/b", Message: tc.message}, failure())
+			recorded := failure()
+			require.Equal(t, tc.status, recorded.Status)
+			require.Equal(t, http.MethodPatch, recorded.Method)
+			require.Equal(t, "/api/v1/repos/a/b", recorded.Endpoint)
+			require.Equal(t, tc.message, recorded.Message)
+			require.Equal(t, server.URL, recorded.Instance)
 		})
 	}
 }