Strip sensitive URL parameters from provider log output

[nickmiller-wf]

Resolves #291

After searching through the providers package manually, I determined the GitHub provider and validateToken helper function were the only areas at risk here. Other providers, like Google, encode their sensitive parameters as a form-encoded body, and they are never logged.

@jehiah

[nickmiller-wf]

For the record, I'm not tied to the name stripToken - naming these little helper functions can be tough sometimes. I'm happy to change it if something else seems more appropriate.

[jehiah]

perfect. and a test for bonus points!

Can you squash down to a single commit?

[nickmiller-wf]

🎉

[nickmiller-wf]

@jehiah When should we expect a new release to be cut? Was having some trouble trying to build locally