[Bug] Authentication audit logs expose request signatures

### Problem
`DefaultAuthenticationProvider.doAuditLog()` writes the raw request signature into authentication audit logs for both failed and successful authentication attempts:

```java
log.info("[AUTHENTICATION] User:{} is authenticated failed with Signature = {}.", context.getUsername(), context.getSignature());
log.debug("[AUTHENTICATION] User:{} is authenticated success with Signature = {}.", context.getUsername(), context.getSignature());
```

Signatures are security-sensitive authentication material and should not be emitted verbatim to logs.

### Impact
Operators may persist raw authentication signatures in log aggregation systems, increasing credential-related exposure risk during authentication failures or debug logging.

### Expected behavior
Authentication audit logs should preserve useful diagnostics, but redact or summarize signatures instead of printing the raw value.

### Code evidence
- `auth/src/main/java/org/apache/rocketmq/auth/authentication/provider/DefaultAuthenticationProvider.java`

### Suggested fix
Mask the signature before logging, and add tests covering both short and long signatures.

Start in auth/src/main/java/org/apache/rocketmq/auth/authentication/provider/DefaultAuthenticationProvider.java and inspect doAuditLog(), including both failed and successful authentication paths. Add focused tests for short and long signatures; done means audit logs retain useful diagnostics without emitting either raw signature.

Written by the indexing model from the issue text.