Always redact SIP authorization credentials

[PetrShtuka]

What changed

• Always scrub Authorization and Proxy-Authorization values from PJSIP protocol traces, regardless of CallWaveLog.redactsIdentifiers.
• Remove folded continuation lines belonging to authorization headers.
• Replace the test that previously preserved raw credentials when identifier redaction was disabled.
• Correct the field-testing guidance and document the security fix.
• Point SwiftPM at the reproducible pjsip-2.17-ios15-opus-sha256.2 binary release.

Why

redactsIdentifiers = false is useful during device field testing, but it incorrectly disabled credential scrubbing too. Raw digest usernames, nonces and responses could therefore reach logs and custom logger callbacks. Identifier visibility and credential safety must be independent controls.

The previous PJSIP .1 tag also predated the SHA-256 patch and Opus license. The new immutable .2 tag points to commit 0522800, which contains the build script, patch, manifest and licenses used by the attached XCFramework.

Impact

Applications can continue exposing UUIDs, caller information and addresses during controlled diagnostics without exposing SIP credentials. The public API and binary checksum are unchanged.

Validation

• Full package test suite passed on iPhone 17 Pro Simulator, including the new credential and folded-header regressions.
• SwiftPM successfully downloaded the published .2 XCFramework and verified its checksum.
• verify-pjsip-xcframework.sh confirmed iOS 15, device/simulator architectures, Apple TLS, IPv6, Opus and SHA-256.
• git diff --check passed.