Feature: Log sanitization and send-before-preview for LLM payloads #184

Summary

Add a log sanitization layer that runs on the build log payload before it is sent to any AI provider, along with an optional preview/audit mechanism so admins can verify what is being transmitted.

Motivation

The plugin sends build log content to external AI providers (OpenAI, Bedrock, Azure, etc.). Enterprise users reasonably worry about whether those logs contain:

• API tokens, passwords, secret keys
• Internal hostnames / IPs / URLs
• Customer data or PII
• License keys
• Private artifact paths or repository info

While the workspace context feature already skips known sensitive files (.env*, credentials*, target/, build/, .git/, etc.), that operates at the file level when gathering workspace context — it does not scrub the log output itself. Logs can easily leak secrets through environment variable dumps, command output, or error traces.

Proposed Capabilities

1. Sanitize before sending to LLM — a configurable regex-based scrubber applied to the log excerpt before it hits the provider API.

   • Common preset patterns for tokens, keys, passwords, URLs, IPs
   • Mask matches with [REDACTED] (or a configurable string)

2. Preview payload before sending (optional) — a "dry run" mode or preview panel in the Jenkins UI that shows what would be sent, so admins can audit before enabling live sanitization.

3. Audit what was sent — log (to Jenkins system log, at a minimum) a sanitized summary of each request: provider, model, log line count, lines redacted, timestamp.

4. Allow/deny regex policy — let admins define custom patterns, with a choice to block sending entirely if certain patterns are detected (i.e., fail closed) vs. redact and proceed.

Non-Goals (for this issue)

• Row-level encryption or tokenisation
• Full DLP integration
• Workspace context changes (already handled separately)

Notes

This is scoped as an opt-in, configurable feature. Default behaviour (no sanitization) stays unchanged for backward compatibility.