fix(logs): don't panic masking a JWT with a short signature (#1761)

## Bug

The log sanitizer's `jwt` regex accepts any non-empty third segment
(`[A-Za-z0-9\-_]+`), but its mask function always takes the last four
characters with `parts[2][len(parts[2])-4:]`. A JWT-shaped string with a
1–3 character signature panics with `slice bounds out of range` inside
`SecretSanitizer.Write`, which zap does not recover. The process logging
the line crashes.

## Trigger

Any log message or field containing, for example:

```
eyJhbGciOiJub25lIn0.eyJzdWIiOiIxIn0.x
```

This can come from upstream tool output, an error body echoed into a
log, or a test or unsigned token. The result is `panic: runtime error:
slice bounds out of range [-3:]`.

## Fix

When the signature is shorter than four characters, mask it fully
(`<header>.***.***`) instead of slicing.

This touches the same `jwt` block that #1760 moves. Whichever lands
second needs a trivial rebase.

## Test

`TestSanitizer_JWTShortSignatureDoesNotPanic` runs signatures of length
1, 2 and 3 through `sanitizeString`, recovers any panic, and checks that
the payload is masked.

## Commands run

- `CGO_ENABLED=0 go test -count=1 ./internal/logs`: ok
- Without the fix, the new test fails on all three inputs with
`panicked: runtime error: slice bounds out of range [-3:]`, `[-2:]` and
`[-1:]`.
- `gofmt -l` on the edited files: no output

Author: rudycelekli

internal/logs/sanitizer.go

@@ -114,6 +114,9 @@ func (s *SecretSanitizer) registerDefaultPatterns() {
 			if len(parts) != 3 {
 				return "****"
 			}
+			if len(parts[2]) < 4 {
+				return parts[0] + ".***.***"
+			}
 			// Show first part (header) but mask payload and signature
 			return parts[0] + ".***." + parts[2][len(parts[2])-4:]
 		},

internal/logs/sanitizer_jwt_short_signature_test.go

@@ -0,0 +1,28 @@
+package logs
+
+import (
+	"strings"
+	"testing"
+)
+
+// The jwt regex accepts a 1-3 character signature segment; masking it must
+// not slice out of range (a panic inside the zap core takes the caller down).
+func TestSanitizer_JWTShortSignatureDoesNotPanic(t *testing.T) {
+	s := newTestSanitizer()
+	const payload = "eyJzdWIiOiIxIn0"
+	for _, sig := range []string{"x", "ab", "abc"} {
+		in := "jwt eyJhbGciOiJub25lIn0." + payload + "." + sig
+		var out string
+		func() {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Errorf("sanitizeString(%q) panicked: %v", in, r)
+				}
+			}()
+			out = s.sanitizeString(in)
+		}()
+		if strings.Contains(out, payload) {
+			t.Errorf("payload leaked: %q", out)
+		}
+	}
+}