CMLDEV-1228: broader security hardening for 2.11.0

[vprysiaz]

Land medium-severity hardening items identified in the security review (H3/H5, M1-M3, M5, M7-M8, L1-L2, L5-L6), separate from the critical H1/H2/H4 fixes already tracked under CMLDEV-1227.

• Refuse username/password auth over cleartext http://; only a pre-obtained jwtoken is permitted (TokenAuth.token). Same gate applied to the websocket transport in EventListener._init_ws_connection_data.
• ClientLibrary.logout() (via TokenAuth.logout) now zeroes cached jwtoken/password after logout.
• set_termserv_credentials rejects key_path values containing whitespace, quotes, or leading-hyphen OpenSSH option syntax.
• upload_image_file caps upload size and enforces an allow-listed filename character set for caller-supplied renames.
• Licensing.set_transport logs only ssms_host=... instead of the full transport data dict.
• TokenAuth caps buffered 4xx/5xx response bodies (auth retries and the initial /authenticate login) at MAX_RESPONSE_BODY_BYTES, scoped to error responses only so normal 2xx payloads are never truncated.
• make_session()/ClientLibrary default to follow_redirects=False, with an opt-in toggle for callers that need it.
• _session.lock and event_listener are always initialized before any code path that can raise or return early in ClientLibrary.init.
• Debug logs sanitize controller-supplied response text (CR/LF stripped, length capped) via a new sanitize_for_log() helper.
• parse_version_str's suffix is capped at 32 chars and restricted to a safe character set instead of an arbitrary tail.

Updates examples/sample.py to require a pre-obtained CML_JWT_TOKEN for http:// controllers, matching the new cleartext-credential refusal.