[fs] Mask S3 delegation token access keys in logs

[QuakeWang]

Purpose

Linked issue: close #1989

The S3 delegation token provider and receiver logged full access key IDs when obtaining or updating temporary session credentials. This exposed credential identifiers in logs, while the log only needs enough information to confirm which key path is being used.

Brief change log

• Add a package-local S3 token log utility to keep a short access-key prefix and mask the rest.
• Mask access key IDs in S3 delegation token provider and receiver logs.
• Add unit tests for null, short, and normal access key values.

Tests

• mvn -pl fluss-filesystems/fluss-fs-s3 -am -Dtest=S3TokenLogUtilsTest -DfailIfNoTests=false clean test

API and Format

Documentation

[luoyuxia]

Thanks. LGTM