fix: harden go-processor logging and tokenURL validation

[mrsabath]

Summary

Two hardening suggestions from @huang195's review of #171 that are deferred to a follow-up.

1. Reduce log verbosity for sensitive identifiers

clientID (SPIFFE URI), audience, and scopes are currently logged at info level in the go-processor's outbound token acquisition paths ([Token Exchange] and [Client Credentials] log lines). In production, this could leak internal service names and SPIFFE URIs.

Proposed fix: Move these to debug level, or only log them on failure paths where the extra context helps troubleshooting.

Files: AuthBridge/AuthProxy/go-processor/main.go (lines ~335-338, ~506-509)

2. Validate tokenURL scheme

The TOKEN_URL environment variable is used without scheme validation. If misconfigured with http://, client credentials would be sent in plaintext. While in-cluster traffic is typically protected by Istio mTLS, defense-in-depth is good practice.

Proposed fix: Log a warning on startup if TOKEN_URL uses http:// instead of https://, or reject it outright with a configuration error.

Files: AuthBridge/AuthProxy/go-processor/main.go (config loading section)

Context

• Review comment: feat: add client_credentials fallback for outbound requests without Authorization header #171
• Reviewer: @huang195