Add option to redact cache upload/download URLs from job logs

Summary

Adds a new RedactURL boolean option under [runners.cache] in config.toml. When set to true, cache upload and download URLs are replaced with generic messages ("Uploading cache to remote storage", "Downloading cache from remote storage") in job logs, avoiding exposure of infrastructure details such as bucket names and object paths.

Root cause

The cache-archiver and cache-extractor helper commands unconditionally log the full cache URL (including bucket name and object path) at logrus.InfoLevel. While CleanURL() strips query parameters (auth tokens), the scheme/host/path still leak infrastructure details like https://storage.googleapis.com/my-company-bucket/runner/project/123/my-cache-key.

What this MR does

1. New config field: [runners.cache] RedactURL = true|false (default false)
2. Helper command flags: Adds --redact-url / CACHE_REDACT_URL to cache-archiver and cache-extractor
3. Both code paths threaded:
   • Shell abstraction (docker, shell, ssh executors)
   • Concrete builder (kubernetes executor)
4. Conditional logging: When redaction is enabled, URL-specific log lines are replaced with generic messages; URL-bearing structured log fields are omitted
5. Backward compatible: Default false preserves existing behavior

Verification

• go build ./... - clean
• go vet ./... - clean (pre-existing magefiles issues only)
• go test ./cache/... - all pass
• go test ./commands/helpers/... - all pass
• go test ./shells/... -run Cache - all pass
• go test ./functions/concrete/... - all pass

Related: #39405 (closed)