Mask Tower Access Token in logs

Bug report

Expected behavior and actual behavior

The .nextflow.log file includes tower access tokens when requests are made to the wave container service. I would expect that value to be excluded or at least masked for security, as I try to avoid storing any tokens in plain text.

Steps to reproduce the problem

Run a nextflow workflow that includes wave.enabled = true and a container

Program output

An example partial line from the logfile showing where the token would be printed.

Jul-29 19:18:56.183 [Actor Thread 9] DEBUG io.seqera.wave.plugin.WaveClient - Wave request: https://wave.seqera.io/v1alpha2/container; attempt=1 - request: SubmitContainerTokenRequest(towerAccessToken:{MASKED_FOR_GITHUB}, towerRefreshToken:null, ...

I am not uploading the full .nextflow.log file because it contains the token.

Environment

Nextflow version: 24.04.3
nf-wave@1.4.2
Java version: 17
Operating system: Linux
Bash version: GNU bash, version 5.2.15

Additional context

I was only looking at the logs because of some failures to pull wave containers, which I thought might have been because of bumping into API limits. I was not able to confirm that or if the failures might have been for other transient reasons.

nextflow-io / nextflow