[codex] log XFCC auth failure headers

[winhowes]

Summary

• Add an auth-plugin logger that is wired to the main service logger.
• Log all request headers when the envoy_xfcc plugin fails incoming authentication.
• Cover failure logging, success no-log behavior, invalid params, identify failure, and logger accessor behavior.

Impact

Operators get the full incoming header context when XFCC auth fails, while successful authentication stays quiet.

Validation

• go test ./app/auth ./app/auth/plugins/envoy_xfcc -coverprofile=/tmp/xfcc-auth.cover
  • app/auth: 100.0% statements
  • app/auth/plugins/envoy_xfcc: 100.0% statements
• go tool cover -func=/tmp/xfcc-auth.cover: total 100.0%
• go test ./app/auth ./app/auth/plugins/envoy_xfcc -count=5
• go test ./... -run '^$' -count=1
• go test -coverprofile=/tmp/authtranslator.cover ./... produced a profile with total 100.0% statement coverage, but exited nonzero locally because TestWatchFilesRename timed out waiting for a write event after rename in this checkout.