fix(logging): mask every *-api-key provider header in the log pipeline (#13273)

[soroush5]

Fixes #13273.

The request-log header mask only knew x-api-key, so Gemini (x-goog-api-key) and Azure (api-key) provider keys were stored verbatim in the log pipeline. This matches any *-api-key spelling instead, same masking style as before. Adds xi-api-key to the persisted-log redaction too, plus a regression test.

[soroush5]

CI status note — I rebased onto current release/v3.8.51 and verified each remaining red gate locally against pristine af49d497:

• The autoCombo TS2739 is fixed in this branch (open-sse typecheck gate green, redaction tests 4/4, logger suites 101/101).
• Everything else still red reproduces on pristine main: skills sync wants cli-tunnel regenerated, file-size flags stream.ts, docs-all reports 7 drifts, ESLint flags the untouched volcengine-*.test.ts, and httpAuthContext.test.ts fails there too. None of these touch this PR's files, so they look like upstream drift rather than regressions from this change.

[diegosouzapw]

Thanks for the careful work here, including the CI-status note pinning down which reds were
pre-existing base drift vs. this PR's own — that kind of diligence makes review much faster.
Since you opened this, #13401 landed (2026-09-14) fixing the exact same gap for the exact same
issue (#13273), which is now closed: it adds xi-api-key to the same redaction set and masks
every *-api-key header spelling in the request-log pipeline, just via a slightly different
matching expression with the same observable effect. Closing this one as subsumed by #13401.

Triage note: this is the review recommendation — the close itself happens only after the maintainer's per-PR sign-off (and, where a superseding PR is named, after it has landed). Nothing is being closed by this comment.