update: only ureq's Trace logs print the GitHub token (#391)

ureq 3.5's Debug request log lists an allow-list of safe headers and
leaves Authorization out; the unredacted wire is its Trace output
(ureq-proto's log_data). `Http::with_github_token` now says so: apps
should redact Bearer tokens or keep `ureq` and `ureq_proto` at Debug or
quieter.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/update/src/http.rs

@@ -132,9 +132,10 @@ impl Http {
     /// An optional token raises GitHub's limit from 60 to 5000 requests an hour. Only ever sent
     /// to api.github.com. Blank means none.
     ///
-    /// ureq's debug and trace logs print request headers, this token's `Authorization: Bearer`
-    /// among them: an app that sets one should redact Bearer tokens in its logger, or keep
-    /// `ureq` and `ureq_proto` below Debug.
+    /// ureq's Debug logs list only an allow-list of safe headers and leave `Authorization` out,
+    /// but its Trace logs are the unredacted wire, this token's `Authorization: Bearer` among it:
+    /// an app that sets one should redact Bearer tokens in its logger, or keep `ureq` and
+    /// `ureq_proto` at Debug or quieter.
     #[must_use]
     pub fn with_github_token(mut self, token: Option<String>) -> Self {
         self.token = token.map(|t| t.trim().to_string()).filter(|t| !t.is_empty());