Mask private client keys in logs

[frankii91]

Summary

Mask privateClientKey values before privacyIDEA Authenticator writes or prints
log messages.

Problem

SecureTokenContainerRepository logs container state while loading and saving
containers. A finalized container's generated toString() includes its
privateClientKey. The logger already redacts several sensitive parameter
names, but privateClientKey was not in that filter list, so exported error
logs could contain the complete private client key.

These logs can be attached to support emails or shared for troubleshooting,
which makes the unredacted value a credential-disclosure risk.

Fix

Add privateClientKey to the logger's existing case-insensitive sensitive
parameter filter. This keeps the current centralized filtering behavior and
does not change container persistence, cryptography, or synchronization.

The public client key and other non-sensitive diagnostic context remain
available in the log.

Tests

• Added a regression test that logs representative finalized-container output.
• Confirmed the test fails on the unmodified base because the sample private
  key is present.
• Confirmed the test passes after the fix, with the private value removed and
  the public key preserved.
• dart analyze lib/utils/logger.dart test/unit_test/utils/logger_test.dart
  reports only three pre-existing prefer_initializing_formals info messages
  in logger.dart; the new test has no diagnostics.