Filter youth/volunteer PII from logs and Bugsnag (notes, case_number, DOB, phone…) #7263

Problem

CASA data is about foster youth, so anything we send to third parties (Bugsnag, Scout APM, Heroku/log drains) should be the minimum needed to debug.

config/initializers/filter_parameter_logging.rb filters only passw, email, secret, token, _key, crypt, salt, certificate, otp, ssn, cvv, cvc. These are permitted request params that aren't filtered, so they appear in Rails logs and in the request metadata Bugsnag attaches to errors:

Also:

• config/initializers/bugsnag.rb calls event.set_user(current_user&.id, current_user&.email). The user id is enough to look someone up. Consider sending only the id.
• Case URLs contain the case-number slug (/casa_cases/cina-21-1234), so it ends up in router logs and Bugsnag App URL. That will matter more once Include the org in CASA case URLs and finish the switch away from database ids #7106 lands org + case number in the path. Look at Bugsnag's redacted_keys / an add_on_error callback that rewrites request.url, and Heroku log drains.

Tasks

• Add :notes, :content, :case_number, :birth, :phone, :address, :display_name, :first_name, :last_name to filter_parameters (it's substring-matched, so check nothing we need in logs gets swallowed)
• Add a spec asserting those keys are filtered (ActiveSupport::ParameterFilter.new(Rails.application.config.filter_parameters).filter(...))
• Decide on set_user email vs id only
• Bugsnag callback that redacts case slugs from event.request[:url] / context
• Note the policy in SECURITY.md: what we send to which vendor

Related: safe read-only observability access (see linked issue).