Debug log leaks secrets from the Hash request body of #get_token

[makssein]

With OAUTH_DEBUG=true, secrets from the request body of #get_token and AccessToken#refresh! end up in the debug log: client_secret (with auth_scheme: :request_body), code_verifier, and refresh_token. These specs reproduce it through the real client calls and currently fail.

This happens because #get_token passes the params to Faraday as a Hash, and the debug logger is added before :url_encoded. So Faraday logs the body via #pretty_inspect, like {"client_secret" => "..."}. SanitizedLogger only redacts the Authorization header, JSON pairs, and key=value pairs, so this format slips through. The existing form-encoded spec doesn't catch it because it passes an already-encoded string to client.request.

This could be fixed by making SanitizedLogger also redact Ruby Hash #inspect output ("key" => "value", key: "value", :key=>"value"). That way it works regardless of the middleware order or a custom connection_build. On top of that, the default connection could add the logger after :url_encoded, so the log shows the real encoded body.