fix(security): redact invalid Bedrock bearer credentials (#2419)

## Summary

- Keep invalid Amazon Bedrock bearer credentials out of native
HTTP-header error messages, stacks, causes, and uncontrolled logs.
- Apply the same narrow, cause-free `TypeError` sanitization to
dependency-free and AWS-backed Bedrock providers and the existing
`BedrockOpenAI` client.
- Preserve valid authorization values, credential-provider failures,
custom caller-header diagnostics, request-header identity, redirect
protections, and network behavior.

## Regression-first proof

The new real-public-client regression produced **37 failing / 12
passing** cases before the production change; all **49 cases pass**
afterward. Coverage spans static and rotating credentials across all
three public Bedrock entrypoints, malformed
line-feed/carriage-return/CRLF/NUL/Unicode values, default logging,
absent causes, unsent requests, caller-header isolation, provider-error
identity, and valid authentication.

A focused inline lint exception documents why preserving the original
credential-bearing error as `cause` would recreate the privacy issue.

## Verification

- **349** focused Bedrock tests passing.
- **3,878** handwritten tests across **122** files passing.
- **559** generated tests across **82** files passing against an
isolated random-port mock.
- Repository formatting/lint and strict TypeScript.
- Full CommonJS/ESM package build; published-source TypeScript **4.9**
and current TypeScript.
- `publint` (only the pre-existing vendor warning) and packed-package
Node 22 checks.
- **24** additional built-package CJS/ESM privacy checks across
dependency-free, AWS-backed, and legacy Bedrock clients with both static
and rotating credentials.