Sanitize "state" in the audit log for `user.created` and `user.authenticated`

Re: https://github.com/authgear/authgear-server/issues/3443#issuecomment-1792131763

In #3443 we made "state" in oauth available for `user.created` and user.authenticated` webhooks.
This also makes the param appears in the corresponding audit logs.

If users uses state param to transport PII, the info may be retained in the audit log, which may be a small privacy concern. We may discuss if the state is needed in the audit log.

Start by reading issue #3443 and its linked implementation of the state parameter for the user.created and user.authenticated webhooks. Trace how that value reaches the corresponding audit logs, then determine the intended sanitization or removal behavior; done means user-supplied state is no longer retained there.

Written by the indexing model from the issue text.