fix(security): credential redaction in 0f8b000 misses JSON bodies access_token, refresh_token, clientSecret, and password print verbatim with --verbose

Nobody has claimed this yet.

## Problem

i added credential redaction to verbose HTTP dumps. It works for `Authorization` headers but misses both places where secrets actually appear.

**Leak 1 Keycloak token response** (`keycloak_client.go:96`)

The response body is JSON. The regex expects `name=value` (form encoding), so `"access_token":"eyJ..."` prints verbatim.

**Leak 2 create-test request body** (`microcks_client.go:371`)

`OAuth2ClientContext` is marshalled into the POST body. Fields `clientSecret`, `password`, and `refreshToken` aren't in the pattern at all.

The header redaction fires correctly, which is exactly what makes this easy to miss:
```
Authorization: [REDACTED] ← works
{"oAuth2Context":{"clientSecret":"SECRET","password":"SECRET",...}} ← leaks
```

## Root Cause

```go
// only matches name=value — never fires on JSON bodies
var sensitiveParamPattern = regexp.MustCompile(
`(?i)(access_token|refresh_token|id_token|code)=([^&\s]+)`,
)
```

Apply it alongside the existing patterns in `redactSensitiveContent`.

## Reproduce

Drop into `pkg/config/redact_probe_test.go` and run `go test ./pkg/config/ -run TestRedactProbe -v` — 6 FAILs, all confirmed against the real function.

Start with redactSensitiveContent and the existing patterns, then run pkg/config/redact_probe_test.go using go test ./pkg/config/ -run TestRedactProbe -v. Check the call sites noted in keycloak_client.go:96 and microcks_client.go:371. Done means the six probe failures pass and access_token, refresh_token, clientSecret, and password no longer print verbatim in verbose output.

Written by the indexing model from the issue text.