Wire logging: drop auth token-exchange records, elide huge payload fields

The option.WithLogger logger also reaches cloud.google.com/go/auth,
which logged its token exchange at Debug — JWT assertion and bearer
token included. wireLogger now allowlists only the compute client's
api request/response records at Debug (fail-closed for future SDK
additions); Warn/Error pass through. String fields over 1KiB (e.g.
Shielded-VM UEFI dbx blobs) are elided recursively by default; the new
--gcp-wire-log-full-payloads flag restores verbatim payloads.

Co-Authored-By: Claude <noreply@anthropic.com>

cmd/main.go

@@ -92,6 +92,7 @@ func main() {
 	var gcAllowNamespaced bool
 	var leaseCooldown, maxLeaseTTL time.Duration
 	var showVersion bool
+	var gcpWireFullPayloads bool
 
 	flag.StringVar(&metricsAddr, "metrics-bind-address", "0", "The address the metrics endpoint binds to. "+
 		"Use :8443 for HTTPS or :8080 for HTTP, or leave as 0 to disable the metrics service.")
@@ -130,6 +131,8 @@ func main() {
 		"Maximum lease TTL a client may request.")
 	flag.BoolVar(&showVersion, "version", false,
 		"Print the commit the binary was built from and exit.")
+	flag.BoolVar(&gcpWireFullPayloads, "gcp-wire-log-full-payloads", false,
+		"Log GCP V(5) wire payloads verbatim instead of eliding fields larger than 1KiB.")
 
 	opts := zap.Options{
 		Development: true,
@@ -160,7 +163,9 @@ func main() {
 	}
 	providers, err := registry.Build(ctx, cfg, map[string]registry.Constructor{
 		"kubernetes": kubernetes.New,
-		"gcp":        gcp.New,
+		"gcp": func(ctx context.Context, pc provider.ProviderConfig) (provider.Provider, error) {
+			return gcp.NewWithWireOptions(ctx, pc, gcp.WireLogOptions{FullPayloads: gcpWireFullPayloads})
+		},
 	})
 	if err != nil {
 		setupLog.Error(err, "Failed to build providers")