fix(auth): sanitize malformed workload OAuth token responses (#2468)

- [x] I understand that this repository is auto-generated and my pull
request may not be merged

## Summary

- Sanitize malformed JSON diagnostics only at the successful
workload-identity OAuth token-exchange response boundary.
- Recognize native and cross-realm syntax errors, nested parser
failures, and supported node-fetch invalid-JSON wrappers without
retaining sensitive response previews.
- Preserve custom response parsers, non-parser transport and provider
error identity, rejected OAuth responses, token caching, and concurrent
refresh behavior.

## Validation

- Regression-first public coverage: 26 failing privacy cases and 18
passing compatibility controls before the fix; all 44 pass afterward.
- Four focused authentication suites: 378 tests passed, including real
loopback OAuth responses, public OpenAI client requests,
malformed-wrapper variants, hostile error objects, recovery, and
concurrency.
- Complete handwritten suite: 146 suites and 6,231 tests passed with
CI-mode snapshot updates disabled.
- Generated API suite: 82 suites and 556 tests passed against an
isolated authenticated Steady server.
- Repository formatting, lint, and source TypeScript checks passed.
- Full production build and generated-package TypeScript 4.9 plus
current TypeScript checks passed.
- Published-package lint and packed CommonJS/ESM verification passed,
including 1,256 source maps.
- Independently verified the actual built CommonJS and ESM OpenAI
clients sanitize both native and supported wrapped OAuth parser
failures.