fix(ASV-4361): close five log-redaction and dispatch findings

[2k-joker]

Summary

Fixes all five findings in the ASV-4361 code-audit and bug-bounty epic. Four touch LogRedactor; one touches Request dispatch.

Ticket	Severity	Fix
ASV-4364	Low	Replace a filtered key's Hash/Array value with redactor_string instead of serializing and truncating it, which leaked the leading and trailing bytes of nested secrets.
ASV-4362	Medium	Recurse unfiltered hash values through the shared redact dispatcher so content/regex filters run against string values inside JSON bodies and headers, not only top-level strings.
ASV-4092	Low	Substitute with gsub's block form so a filter's replacement stays literal. The string form expanded backreferences (\1, \&), re-emitting the secret in plaintext.
ASV-4090	Low	Skip nil captures from zero-width groups instead of concatenating nil and raising TypeError, which silently dropped audit-log entries in production.
ASV-4091	Low	Dispatch the validated sym_method rather than the caller's raw object. send resolves a non-Symbol argument via to_str, so an object with divergent to_sym/to_str bypassed the HTTP-method allow-list.

Testing

• Added specs for each finding: nested-collection redaction, content filters on hash values, literal backreference handling, empty-capture safety, and the to_sym/to_str dispatch guard.
• bundle exec rspec — 122 examples, 0 failures.
• bundle exec rubocop — no offenses.

Ran /simplify, /code-review, and /security-review over the diff. /simplify and /code-review surfaced a dispatcher-duplication cleanup and redundant regex recompilation, both applied. /security-review found no new vulnerabilities.

🤖 Generated with Claude Code