Bug 3390: Proxy auth data visible to scripts (#2249)

Bug 3390: Proxy auth data visible to scripts (#2249)

Original changes to redact credentials from error page %R code
expansion output was incomplete. It missed the parse failure
case where ErrorState::request_hdrs raw buffer contained
sensitive information.

Also missed was the %W case where full request message headers
were generated in a mailto link. This case is especially
problematic as it may be delivered over insecure SMTP even if
the error was secured with HTTPS.

After this change:
* The HttpRequest message packing code for error pages is de-duplicated
  and elides authentication headers for both %R and %W code outputs.
* The %R code output includes the CRLF request message terminator.
* The email_err_data directive causing advanced details to be added to
  %W mailto links is disabled by default.

Also redact credentials from generated TRACE responses.

---------

Co-authored-by: Alex Rousskov <rousskov@measurement-factory.com>