tools-log API: secret matcher to extend log masking with own secret classes, request-scoped registry of secrets to mask, scanner contract; no dependencies beyond the JDK