Fixes the admin API request logging path so sensitive request headers are redacted instead of being logged verbatim.

Before this change, adminHandler.ServeHTTP logged headers with zap.Reflect("headers", r.Header), which bypassed the normal header redaction behavior used elsewhere in the codebase. This could expose values from headers such as Authorization, Proxy-Authorization, Cookie, and Set-Cookie in admin API logs.

This change replaces that raw header logging with a structured marshaler that redacts those sensitive headers while leaving ordinary headers visible.

Why adminLoggableHTTPHeader instead of reusing loggableHTTPHeader?

• The existing reusable header marshaler lives in modules/caddyhttp, but admin.go is in the root caddy package. Importing modules/caddyhttp from admin.go creates an import cycle (caddy -> modules/caddyhttp -> caddy) so the admin handler cannot directly reuse that type. For this fix, the smallest clean option is to keep an admin-specific private marshaler in admin.go with the same redaction behavior.

This change:

• redacts Authorization, Proxy-Authorization, Cookie, and Set-Cookie in admin API request logs
• adds a regression test covering sensitive-header redaction in the admin handler

Should fix #7566.

Assistance Disclosure

No AI was used.