Redact Bedrock API keys from debug output (#40706)

## Why

Derived debug formatting exposed the managed Amazon Bedrock API key.

## What changed

Implement custom `Debug` formatting for `BedrockApiKeyAuth` that replaces the
API key with `<redacted>` while retaining the region.

## Testing

Add regression coverage for direct and `CodexAuth`-wrapped debug output.

GitOrigin-RevId: 68920fa00a9189c959b0025f22797b32f53d1995