fix(googlereader): avoid logging the auth token in clear text

When the Google Reader auth token did not have the expected
username/hash structure, the middleware logged the raw token taken
from the Authorization header or the T form field. A malformed token
can still contain a real or partial credential, so it should not end
up in the logs. The client IP and user agent are still logged.

Fixes code scanning alert #203 (go/clear-text-logging).

internal/googlereader/middleware.go

@@ -117,7 +117,6 @@ func (m *authMiddleware) serveValidated(w http.ResponseWriter, r *http.Request,
 			slog.Bool("authentication_failed", true),
 			slog.String("client_ip", clientIP),
 			slog.String("user_agent", r.UserAgent()),
-			slog.String("token", token),
 		)
 		sendUnauthorizedResponse(w, r)
 		return