MOAD-0004 CWE-312: EveHttpLogJSONHeaders() in output-json-http.c logs HTTP
credential headers (Authorization, Proxy-Authorization, Cookie, Set-Cookie)
verbatim when dump-all-headers or custom field logging is enabled. Patch adds
a credential denylist that emits "[REDACTED]" instead of the raw value.
Default suricata.yaml.in shows Authorization as a custom field example with
no warning. Unit test 5/5 PASS.
MOADs 0001/0002/0003/0005 CLEAN: bitarray+hash+radix+RB-tree hot paths,
per-tenant DetectEngineCtx, thread-scoped thread_local, HRLOCK-guarded THash.
russell@unturf.com
6be275b46d