fix: expand SENSITIVE_HEADERS to cover proxy and gateway credential headers

[bunlongheng]

Summary

SensitiveHeadersFilter was introduced to keep credentials out of debug logs, but SENSITIVE_HEADERS only covers 3 header names:

# before
SENSITIVE_HEADERS = {"api-key", "authorization", "x-amz-security-token"}

This means credentials passed via extra_headers or default_headers to common proxy/gateway setups are logged verbatim when OPENAI_LOG=debug:

• x-api-key - used by AWS API Gateway, Kong, LiteLLM, and Anthropic-style proxies
• proxy-authorization - standard HTTP proxy credential header (httpx itself redacts this in its repr)
• cookie / set-cookie - session-authenticated gateways

Change

# after
SENSITIVE_HEADERS = {
    "api-key",
    "authorization",
    "cookie",
    "proxy-authorization",
    "set-cookie",
    "x-amz-security-token",
    "x-api-key",
}

One test added covering all 4 new headers with mixed-case variants (the filter already lowercases before matching).

Verification

pytest tests/test_utils/test_logging.py  # 6 passed

[ting-hong-shieh]

I reproduced a response-path gap at 070060b27ced1587d185081aefa32d05c0e0a778 and on a clean synthetic merge with current main (d9029e3ada3c008b4631d78a425743445730892a).

SensitiveHeadersFilter.filter() only rewrites dictionary-shaped record.args containing a nested headers dictionary. The actual response log in _base_client.py passes response.headers as the fifth positional argument, so adding set-cookie here does not redact it. A models.list() call against an in-process httpx.MockTransport returned this log:

HTTP Response: GET https://example.test 200 OK Headers({'set-cookie': 'session=secret'})

Could you either extend the filter to cover the response-log argument shape and add a regression through that path, or remove set-cookie from this PR's stated coverage? The request-options path for the other added headers is covered by the new test.

Verification: the focused logging suite passes (6 passed), Ruff lint passes, and git diff --check passes. ruff format --check also reports that tests/test_utils/test_logging.py would be reformatted. The reproduction uses an in-process mock transport, with no network service or credentials.