[Security] Redact credential-like query parameters from NGINX and API access logs

[jnauska]

Problem

Kasm component requests can include JWT-like credentials in query parameters.

Two affected paths were observed with chart 1.1190.6 / Kasm 1.19.0:

• NGINX uses query-bearing variables such as $request and $query_string.
• Python cherrypy.access can log the complete request target.

Affected endpoints include:

• /api/admin/register_component
• /api/kasm_session_log
• /api/admin/get_server_file_mappings

Example:

GET /api/admin/register_component?token=example.jwt.value HTTP/1.1

Expected behavior

• Use a query-free NGINX representation such as $request_method $uri $server_protocol.
• Remove $request, $request_uri, $args, $query_string, and the JSON query_string field.
• Redact values for case-insensitive parameters named token, access_token, auth_token, session_token, and jwt before Python handlers write them.
• Apply protection to both logFormat: log and logFormat: json.
• Preserve normal sanitized access logs and useful diagnostic fields.