Record the series key by id in audit metadata, not by name (#108)

CodeQL flagged the Series API's audit write as clear-text storage of
sensitive data (rb/clear-text-storage-sensitive-data, high): it traces the
read of `name` off a series API token into audit_logs.metadata, which is a
plain jsonb column.

The name was never a secret -- it is the display label built from the
creator's email local part, and the secret itself is only ever held as a
SHA256 digest. But the metadata does not need the label: storing the key's id
instead removes the flagged dataflow entirely and is more useful to an
auditor, since an id survives a rename or a rotation, resolves to the key's
name, creator and revocation state, and revoking a key keeps its row.

Author: leowilkin

app/controllers/api/v1/series/events_controller.rb

@@ -160,7 +160,7 @@ def grant_token_owner_event_admin
         end
 
         # API-key requests have no current_user, so the token's owner is the
-        # closest thing to an actor; the token name goes in the metadata either
+        # closest thing to an actor; the key's id goes in the metadata either
         # way so a series key's writes are attributable.
         def log_event_change(action)
           AuditLog.log!(
@@ -174,7 +174,11 @@ def log_event_change(action)
               user_agent: request.user_agent,
               source: "series_api",
               series_id: @series.id,
-              series_api_token_name: current_series_api_token&.name
+              # The key's id, not its name: audit_logs.metadata is stored in
+              # clear text, and an id is provably not a credential. It also
+              # outlives a rename or a rotation, and revoking a key keeps its
+              # row, so this always resolves to the key that acted.
+              series_api_token_id: current_series_api_token&.id
             }.compact
           )
         rescue StandardError => e

spec/requests/api/v1/series_events_spec.rb

@@ -154,7 +154,7 @@ def valid_attributes(overrides = {})
       expect(log.action).to eq("record_create")
       expect(log.actor).to eq(owner)
       expect(log.metadata["source"]).to eq("series_api")
-      expect(log.metadata["series_api_token_name"]).to eq("owner-series-events@ops")
+      expect(log.metadata["series_api_token_id"]).to eq(SeriesApiToken.last.id)
     end
 
     describe "non-series credentials" do