Fix runtime bounds error in hideTokens

[sentry]

This PR addresses a runtime.boundsError that occurred in the hideTokens function (internal/app.go) when masking URL query parameters.

Root Cause:
The hideTokens function unconditionally sliced pToken[:4], pStud[:4], and pPers[:4] to mask sensitive information. This led to a panic if any of these query parameters were shorter than 4 characters, as the slice operation would go out of bounds.

Solution:
The slicing operations have been updated to use [:min(4, len(x))] for pToken, pStud, and pPers. This ensures that the slice upper bound is always valid, preventing the runtime error when a parameter is shorter than 4 characters, while still masking the first 4 characters when available.

Fixes CALENDARPROXY-2