feat: add safe configurable iOS HTTP logging

[mohamede1945]

Summary

• Configure Darwin Ktor logging through MOBILE_SYNC_HTTP_LOG_LEVEL (ALL, BODY, HEADERS, INFO, or NONE).
• Emit Ktor messages to standard output so Xcode and Simulator log capture receive request and response bodies.
• Redact authorization, cookie, and x-auth-token headers.
• Scrub OAuth access tokens, refresh tokens, ID tokens, authorization codes, and PKCE verifiers from verbose bodies.
• Add regression coverage for OAuth log sanitization.

Why

KMP API traffic was difficult to inspect from the iOS example app because the prior logger did not reach the captured console. Enabling verbose OAuth logging also exposed credentials, so debugging must remain safe by default.

Validation

• ./gradlew :auth:allTests
• ./gradlew :syncengine:allTests
• Built the debug XCFramework and consumed it through mobile-sync-spm in the QuranEngine example app.
• Captured a live sync request/response and verified credential redaction.