Auth-token credential leaks into the audit row via the forensic request_uri

The module's stated guarantee is that a WebDAV operation's audit row never carries a working-credential trace. With the webdav module's URL-token authentication, that guarantee does not hold.

Mechanism. WebDavEventContributor removed the request_uri key from the webdav event context (it carries the URL-token segment, e.g. the 1-MQ1LuKa... prefix). But AuditTrail::event() then forensic-stamps the transient bucket with request_uri set to $request->getRequestUri() using the += operator, which fills only keys that are absent. Because the contributor removed the key, the forensic stamp re-adds it, and on a URL-token request the Drupal request URI is the same path. The token lands in context_transient.

Impact (scoped). The leaked value is a per-file WebDAV token (HMAC over fid / filename / revocation-version), not an account credential, and it is bound to the user's session: the per-user master secret is revoked on logout and expires with session.gc_maxlifetime. So a reader of the audit log could, only within the victim's session window, reach the specific file(s) whose tokens passed through the log -- not the account, and not files the user never touched. The exposure is narrow and time-boxed, but it still contradicts the module's guarantee, and a forensic log is read by auditors / admins / backups who should not receive even a scoped credential.

Fix. The contributor must leave request_uri present but empty rather than removing it, so the forensic += cannot overwrite the blanked value. The resource column already records the path without the credential.

Test. Add a kernel test that pushes a real URL-token request onto the request stack (the existing strip test ran with an empty stack, so it could not catch this) and asserts the persisted request_uri is blank. Verified it fails before the fix and passes after.

Also in this MR (same audit). Correct README inaccuracies: the chain claims the audit_trail_webdav channel (not webdav) in mode: flag (not auto), and its edit path is /admin/config/system/audit-trail/chains/audit_trail_webdav/edit.

Found during a post-release audit of the 1.0.0-alpha1 code.