Add HttpApi.RedactedNames for span redaction of query and header names - #9995

Adds HttpApi.RedactedNames, an annotation that lists query parameter and header wire names to redact in spans. It covers values that are only sometimes secret, like Docker's buildargs or remote, which aren't modelled as Redacted. Requested in a comment on #9882.

const Build = HttpApiEndpoint.post("build", "/build", { query: { buildargs, remote, t } })
  .annotate(HttpApi.RedactedNames, { query: ["buildargs", "remote"], headers: ["x-registry-config"] })

• Names can be set on the API, a group or an endpoint, and all levels are combined. They add to UrlParams.CurrentRedactedNames and Headers.CurrentRedactedNames instead of replacing them, so defaults like sig still apply. A string query name also matches nested keys such as buildargs[NPM_TOKEN].
• Client: the request of the endpoint runs with both redacted-name references extended.
• Server: HttpApiBuilder writes the names into the request state before middleware and decoding run, so a 400 is redacted too. HttpMiddleware.tracer adds them to the fiber refs for the URL and header attributes. The tracer records attributes after the handler has restored its context, so a scoped update wouldn't reach them.

Out of scope, and documented on the annotation: addHttpApi treats RedactedNames like any other annotation, and user_agent.original and span error messages are recorded as is. Dropping the query string from server error messages is tracked separately.

Closes EFF-2975