Fix: Credential masking and add path traversal validation

[jmadhur87]

1. Credential Masking Fixes

• Fixed broken log masking for Aviator admin private keys and user tokens
• Moved @MaskValue annotations from field level to class level where log masking framework expects them

2. Reduced Token Logging

• Removed full token values from INFO-level logs in token revocation/deletion commands
• Logs now only identify the email address without exposing the token itself

3. Path Traversal Validation

• Added version string validation in ToolInstallationDescriptor
• Validates that tool version strings contain only safe characters [A-Za-z0-9._+-]
• Blocks path traversal attempts (e.g., ../../sensitive-file) in externally-sourced tool-definitions