fix: redact sensitive API error headers

[ryanduguid]

Summary

• redact credential-bearing request and response headers before they are retained in ApiError
• preserve safe diagnostic headers such as Accept, request IDs, content type, and rate-limit metadata
• add regression coverage against the serialized payload constructed by generated API clients

This is intentionally additive to the currently open error-object work (#812 / #816): whichever error representation is adopted should not expose request credentials or response cookies.

Validation

• npm test -- --runInBand src/test/apiError.spec.ts
• npm test -- --runInBand
• npm run build
• git diff --check