Hash Variant object keys in ExpressionUtil.sanitize (not only values)

> After review, this is not considered a serious vulnerability that needs to be kept private. Sanitized expressions are an operator metrics/log surface, but Variant object keys are query literals and should be hashed like other strings. Filed publicly as a sanitizer bug.

# Summary

`ExpressionUtil.sanitize` is meant to redact predicate constants (hashed strings, digit-count for numbers, coarse dates). For Variant objects it formats keys as `(hash-%s)` **with the original field name**, then sanitizes the value. `TestExpressionUtil` currently expects that: keys look like `(hash-event_name)` while values look like `(hash-79b17dd6)`.

Variant object keys are user data (they can hold the same secrets people put in string literals). Iceberg schema column names in the expression stay visible on purpose; these keys should not.

Consumers of the sanitized string include `SnapshotScan` `ScanReport.filter` (REST catalog metrics when `v1/report-metrics` is on) and any other `ExpressionUtil.sanitize` caller.

Fix: run object keys through `sanitizeSimpleString` (same as string values) and update the unit test.

# Affected Maven coordinates

* `org.apache.iceberg:iceberg-api`

# Attacker prerequisites

* a query (or bound expression) whose Variant literal uses sensitive strings as object keys
* read access to sanitized scan filters (metrics reporter / logs), not table data

# Impact

* Predicate constants that people believed were hashed can appear in ScanReport / logs as Variant keys
* Does not grant table access; it is a sanitizer miss on an operator surface

# Proof status

Source review. Visible in `sanitizeVariantObject` and the existing unit test expectations.

# Key source references

* `org.apache.iceberg.expressions.ExpressionUtil` (`sanitizeVariantObject`, format `(hash-%s)` with `field`)
* `org.apache.iceberg.expressions.TestExpressionUtil` (Variant sanitize test)
* `org.apache.iceberg.SnapshotScan` (`ExpressionUtil.sanitize` into `ScanReport`)

# Related

* [apache/iceberg#11479](https://github.com/apache/iceberg/issues/11479) / [PR #13137](https://github.com/apache/iceberg/pull/13137) added recursive Variant sanitizing. That ticket’s example kept object keys in the clear (`hash-id`) and hashed/coarsened values. This issue is a follow-up: keys are query data (like map-key literals on `mp.key`), not schema identifiers, and should go through `sanitizeSimpleString`. No open issue covers hashing the keys.

Start in org.apache.iceberg.expressions.ExpressionUtil at sanitizeVariantObject and inspect how object keys are formatted versus values. Update the Variant sanitization test in org.apache.iceberg.expressions.TestExpressionUtil, then run that unit test. Done means sensitive Variant object keys are sanitized like string values while schema column names remain visible.

Written by the indexing model from the issue text.