fix(security): close final code-scanning findings + fix Security Heavy fuzz job

[szibis]

Closes the last two open alerts on the code-scanning page.

1. CodeQL HIGH go/clear-text-logging — internal/proxy/query_translation.go

The request log no longer emits auth.principal at all. The Basic-Auth username is credential material read from the Authorization header; the previous sha256 fingerprint still tripped CodeQL's dataflow (it doesn't treat the custom hash as a sanitizer). Now no credential-derived value reaches the log in any path — only auth.source (a constant mechanism label like basic_auth). Trusted-proxy enduser.* fields still carry identity for audit.

Test updated: TestRequestLogger_DoesNotLogBasicAuthPrincipal asserts the principal never appears (default and -debug-log-raw-queries), and neither username nor password leak.

2. Semgrep httpsconnection-detected — scripts/check-vl-ast-coverage.py

Replaced http.client.HTTPSConnection with urllib.request using the default verified TLS context and a fixed, non-user-controlled URL. The resulting dynamic-urllib-use-detected (a false positive for this constant URL) is added to the existing Semgrep --exclude-rule allowlist in security-heavy.yaml.

Verification

• go build ./... ✅, go test ./internal/proxy/ ✅
• Script runs via urllib against the GitHub API ✅
• semgrep scan with the CI config (p/default + owasp + secrets) + the new exclude → 0 findings on the script ✅

3. Security Heavy / fuzz job (was failing on main)

go test -fuzz=FuzzExtractLogPatterns refused to run — the unanchored pattern also matched the newer FuzzExtractLogPatternsFromWindowEntries target, and Go's -fuzz must match exactly one. All -fuzz patterns are now anchored (^...$), and the previously-uncovered window-entries target is now fuzzed. Verified each target runs standalone.

[github-actions]

PR Quality Report

Compared against base branch main.

Coverage and tests

Signal	Base	PR	Delta
Test count	4793	4795	2
Coverage	85.1%	85.0%	-0.1% (stable)

Compatibility

Track	Base	PR	Delta
Loki API	100.0%	11/11 (100.0%)	0.0% (stable)
Logs Drilldown	100.0%	17/17 (100.0%)	0.0% (stable)
VictoriaLogs	100.0%	11/11 (100.0%)	0.0% (stable)

Performance smoke

Lower CPU cost (ns/op) is better. Lower benchmark memory cost (B/op, allocs/op) is better. Higher throughput is better. Lower load-test memory growth is better. Benchmark rows are medians from repeated samples.

Signal	Base	PR	Delta
QueryRange cache-hit CPU cost	3065.0 ns/op	3051.0 ns/op	-0.5% (stable)
QueryRange cache-hit memory	1184.0 B/op	1184.0 B/op	0.0% (stable)
QueryRange cache-hit allocations	29.0 allocs/op	29.0 allocs/op	0.0% (stable)
QueryRange cache-bypass CPU cost	3329.0 ns/op	3405.0 ns/op	+2.3% (stable)
QueryRange cache-bypass memory	1245.0 B/op	1245.0 B/op	0.0% (stable)
QueryRange cache-bypass allocations	30.0 allocs/op	30.0 allocs/op	0.0% (stable)
Labels cache-hit CPU cost	698.4 ns/op	711.2 ns/op	+1.8% (stable)
Labels cache-hit memory	48.0 B/op	48.0 B/op	0.0% (stable)
Labels cache-hit allocations	3.0 allocs/op	3.0 allocs/op	0.0% (stable)
Labels cache-bypass CPU cost	1270.0 ns/op	1277.0 ns/op	+0.6% (stable)
Labels cache-bypass memory	392.0 B/op	391.0 B/op	-0.3% (stable)
Labels cache-bypass allocations	14.0 allocs/op	14.0 allocs/op	0.0% (stable)

State

• Coverage, compatibility, and sampled performance are reported here from the same PR workflow.
• This is a delta report, not a release gate by itself. Required checks still decide merge safety.
• Performance is a smoke comparison, not a full benchmark lab run.
• Delta states use the same noise guards as the quality gate (percent + absolute + low-baseline checks), so report labels match merge-gate behavior.