feat(api): add --verbose to show the request and response headers

--verbose prints the method, URL without query and headers of each request, then the status and headers of its response, on stderr like curl -v. Credentials in Authorization, Proxy-Authorization and Cookie are hidden.

Signed-off-by: bircni <bircni@icloud.com>

internal/app/api_test.go

@@ -265,6 +265,23 @@ func TestAPIFiltersAndFormatsJSONResponses(t *testing.T) {
 	requireUsageBeforeRequests(t, "api returns raw responses; --json is not supported", "api", "version", "--json")
 }
 
+func TestAPIVerboseShowsRequestAndResponseWithoutCredentials(t *testing.T) {
+	server := newAuthenticatedServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("X-Tea-Test", "response")
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	defer server.Close()
+	deps, out, diagnostics := serverDeps(t, server.URL)
+	require.NoError(t, Execute(context.Background(), deps, []string{"api", "version?access_token=secret", "--verbose", "-H", "X-Request: one"}))
+	require.Equal(t, "{}", out.String())
+	head := diagnostics.String()
+	for _, want := range []string{"> GET " + server.URL + "/api/v1/version\n", "> Authorization: (hidden)\n", "> X-Request: one\n", "< HTTP/1.1 200 OK\n", "< X-Tea-Test: response\n"} {
+		require.Contains(t, head, want)
+	}
+	require.NotContains(t, head, "secret")
+	require.NotContains(t, head, "token token")
+}
+
 func TestAPIHelpShowsJQ(t *testing.T) {
 	deps, out, _ := testDeps(t)
 	require.NoError(t, Execute(context.Background(), deps, []string{"api", "--help"}))