fix: expand SENSITIVE_HEADERS to cover proxy and gateway credential headers

[bunlongheng]

Summary

SensitiveHeadersFilter was introduced to keep credentials out of debug logs, but SENSITIVE_HEADERS only covers 3 header names:

# before
SENSITIVE_HEADERS = {"api-key", "authorization", "x-amz-security-token"}

This means credentials passed via extra_headers or default_headers to common proxy/gateway setups are logged verbatim when OPENAI_LOG=debug:

• x-api-key - used by AWS API Gateway, Kong, LiteLLM, and Anthropic-style proxies
• proxy-authorization - standard HTTP proxy credential header (httpx itself redacts this in its repr)
• cookie / set-cookie - session-authenticated gateways

Change

# after
SENSITIVE_HEADERS = {
    "api-key",
    "authorization",
    "cookie",
    "proxy-authorization",
    "set-cookie",
    "x-amz-security-token",
    "x-api-key",
}

One test added covering all 4 new headers with mixed-case variants (the filter already lowercases before matching).

Verification

pytest tests/test_utils/test_logging.py  # 6 passed