fix: redact session identities and quote callback logs

[linkdata]

Merge order: #16, #17, #18, then #19.

Auth debug logs use session_prefix, the first four characters of the JaWS session cookie, to correlate sessions with browser cookies. Cookies shorter than 12 characters have no logged prefix, leaving at least eight base-32 characters undisclosed. The prefix exposes up to 20 bits of the 64-bit random session ID.

OAuth2 callback error fields remain untrusted browser input and preserve the provider's text. The demo quotes errors when logging, and FailedFunc documentation tells applications to quote logged errors and escape rendered output.

Validation: go test -race ./..., go vet ./..., go build ./..., golangci-lint run, and gosec ./... in both Go modules. Local staticcheck ./... reported matched no packages in both modules.

Closes #11
Closes #13