fix(auth): redact non-OAuth credential secrets from the auth request event

[herdiyana256]

The adk_request_credential event is streamed to the client and appended to the session, so the redaction applied before it goes out has to cover every secret the credential can carry. _credential_without_client_secret in auth/auth_handler.py only nulled oauth2.client_secret, and _generate_auth_request returns the auth config unchanged for any non-OAuth scheme, so an api_key, an HTTP Basic password, or a service account private_key reached the client verbatim through generate_auth_request and flows/llm_flows/functions.py:build_auth_request_event, and stayed readable in the session. The workflow human-in-the-loop path had the same oauth2-only gap in its own _without_client_secret helper.

This is the same class the A2A relay path already handles by dropping the whole credential-bearing part (agents/remote_a2a_agent.py), whose comment notes the arguments carry "an OAuth2 client secret or a service account key". The direct-to-client and workflow paths keep the non-secret fields the client legitimately needs (scheme, client_id, generated auth_uri, state) and strip the secrets instead of the whole part.

This change nulls api_key, http.credentials.password, and the service account private_key alongside oauth2.client_secret on both helpers. A normal OAuth2 request keeps its client_id and generated auth_uri and only loses client_secret, so the consent flow is unchanged. Adds unit tests for the API-key and service-account cases and updates the existing non-OAuth test that had asserted the full credential was returned.