Function redactQueryTokens

text with the value of every secret query parameter replaced by *** (?token=abc → ?token=***), and every listed token value (as queryTokensIn returns them, or decoded) replaced wherever it occurs alone — a server's "invalid token abc" echoes it without the parameter name. Values shorter than six characters are only redacted in their token= form, which a server may echo without the ? or & (raw token=ab12): a listed value is redacted after a bare token= or access_token= too.