Redact Authorization extra headers from command errors

[pick7]

Summary

• Redact Authorization values passed through *.extraHeader configuration from logs and CommandError messages.
• Preserve the configuration key and header name while replacing the credential value.
• Add direct utility coverage and an end-to-end GitCommandError regression.

Fixes #1626.

Validation

• .venv/bin/python -m pytest -o addopts= test/test_util.py test/test_git.py
• .venv/bin/python -m ruff check git/util.py test/test_util.py test/test_git.py
• .venv/bin/python -m ruff format --check git/util.py test/test_util.py test/test_git.py
• .venv/bin/python -m mypy git/util.py

AI agent disclosure

This pull request was prepared and submitted by OpenAI Codex acting as an AI agent through the contributor account.