fix: redact logging of sensitive config & CSRF validation

[psyke83]

• Currently redacts csrf_allowed_origins.
• Add simple validation of CSRF entries to ensure they are prefixed
  with 'https://'.
• Individual invalid CSRF entries will be logged unredacted to assist
  troubleshooting.

Description

Screenshot

Issues Fixed or Closed

Roadmap Issues

Type of Change

• feat: New feature (non-breaking change which adds functionality)
• fix: Bug fix (non-breaking change which fixes an issue)
• docs: Documentation only changes
• style: Changes that do not affect the meaning of the code (white-space, formatting, missing semicolons, etc.)
• refactor: Code change that neither fixes a bug nor adds a feature
• perf: Code change that improves performance
• test: Adding missing tests or correcting existing tests
• build: Changes that affect the build system or external dependencies
• ci: Changes to CI configuration files and scripts
• chore: Other changes that don't modify src or test files
• revert: Reverts a previous commit
• BREAKING CHANGE: Introduces a breaking change (can be combined with any type above)

Checklist

• Code follows the style guidelines of this project
• Code has been self-reviewed
• Code has been commented, particularly in hard-to-understand areas
• Code docstring/documentation-blocks for new or existing methods/components have been added or updated
• Unit tests have been added or updated for any new or modified functionality

AI Usage

• None: No AI tools were used in creating this PR
• Light: AI provided minor assistance (formatting, simple suggestions)
• Moderate: AI helped with code generation or debugging specific parts
• Heavy: AI generated most or all of the code changes

[ReenigneArcher]

If we're going to do this, can you add some basic regex validation to the allowed origins options so if it's not properly formatted it will at least log an error/warning. I think we basically only need to check that it starts with https://.

[psyke83]

@ReenigneArcher

Ready for review. I would say that the remaining SonarQube errors can be disregarded, as I'm following the established signature of apply_config's vars, and the new function's purpose is aimed at cutting down duplication of redaction logic in main.cpp. Let me know if you disagree.

It currently is only doing CSRF validation on the basis that the string is >8 chars and starts with 'https://'.

[codecov]

Bundle Report

Bundle size has no change ✅

[sonarqubecloud]

Quality Gate failed

Failed conditions
2 New issues
2 New Code Smells (required ≤ 0)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE