server: the login rate limiter logs the attempted principal at WARN #918

When the login rate limiter refuses a principal, it logs the name that the caller sent. It logs at WARN, which the default log level includes (crates/server/src/rate_limit.rs:183 on main at 35edb77):

Login refused: principal {:?} from {} has {recorded_for_pair} failed attempts and {} in flight in window

Suppose a client sends a password in the user name field. If it logs in again after 5 failures from one address, the server log gets that password. The logged value is at most 256 bytes, and {:?} escapes newlines and control characters, so the line cannot forge another log line.

A fix could log a hash of the principal instead of its text.

The description of #849 notes this, and the review of #849 asks for an issue.