Redact Authorization extra headers from command errors

[pick7]

Summary

• Redact Authorization values passed through *.extraHeader configuration from logs and CommandError messages.
• Preserve the configuration key and header name while replacing the credential value.
• Add direct utility coverage and an end-to-end GitCommandError regression.

Fixes #1626.

Validation

• .venv/bin/python -m pytest -o addopts= test/test_util.py test/test_git.py
• .venv/bin/python -m ruff check git/util.py test/test_util.py test/test_git.py
• .venv/bin/python -m ruff format --check git/util.py test/test_util.py test/test_git.py
• .venv/bin/python -m mypy git/util.py

AI agent disclosure

This pull request was prepared and submitted by OpenAI Codex acting as an AI agent through the contributor account.

[Copilot]

Pull request overview

This PR addresses credential leakage in GitPython error/log output by extending command-line redaction to cover http.*.extraHeader Authorization headers (e.g. when passed via -c http.extraHeader=Authorization: …), aligning behavior with existing URL user/pass redaction and fixing #1626.

Changes:

• Extend remove_password_if_present() to redact *.extraHeader=Authorization: ... values while preserving the config key and header name.
• Add direct unit coverage for remove_password_if_present() redaction of Authorization extra headers.
• Add an end-to-end regression test ensuring GitCommandError messages do not include Authorization tokens.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
git/util.py	Adds redaction logic for *.extraHeader=Authorization: arguments in remove_password_if_present().
test/test_util.py	Adds a focused unit test covering Authorization extra header redaction.
test/test_git.py	Adds a regression test asserting Authorization tokens are redacted from GitCommandError messages.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Byron]

Thanks a lot, LGTM!