Forensic request_uri is captured unsanitized, so URL-borne secrets can land in the audit log

AuditTrail::event() and AuditTrailLogger both forensic-stamp the transient bucket with request_uri set to the raw $request->getRequestUri() (AuditTrail.php and AuditTrailLogger.php), with no sanitization. Whenever an audited action runs during a request whose URL carries a secret, that secret is written verbatim into the audit row.

This is not specific to one module. Any credential-in-URL pattern is affected, for example:

• Drupal's own one-time-login links, /user/reset/[uid]/[timestamp]/[hash]/login -- the hash is a working login credential;
• user cancel-confirmation links (hash in the path);
• query-string tokens and signed URLs (?token=..., access tokens, and similar).

The audit log is read by auditors, admins, and anyone with a database or backup copy -- exactly the parties who should not receive these secrets. The value also persists for the retention window.

Context. This surfaced in audit_trail_webdav (#3594323): the WebDAV URL-token landed in the row via this forensic stamp. That bridge worked around it by blanking request_uri in its own ContextContributor (it must set the key empty, not remove it, because the += in event() refills absent keys). But that is a per-consumer workaround for a producer-side behaviour, so every other channel stays exposed.

Recommended approach. Sanitize at the single choke point rather than per consumer. request_uri is useful forensic data, so the goal is to scrub secrets, not drop the field. Options, roughly in order of preference:

• A redaction seam (an event, or a swappable service) invoked on the forensic envelope before it is written, so a module can register a sanitizer for its own URL shapes. This is the general fix and lets webdav drop its workaround.
• A conservative default on top of that: strip the query string from the stored request_uri (catches ?token= without per-module knowledge), and/or redact known core credential-bearing routes (user/reset and similar).

Whatever the mechanism, both write paths (AuditTrail::event() and AuditTrailLogger) must go through it so the chain and PSR-3 sinks behave the same.

No patch attached; filing to capture the risk and agree the approach first.