fix: always redact sensitive rejected values

[brownie-cake]

What

Add a sensitive-property denylist to DefaultValidationRejectedValueSanitizer.

Why / root cause

When the diagnostics switch exposeRejectedValue was enabled, rejected passwords, tokens, secrets, and credentials could be reflected into validation responses or logs. The global exposure switch overrode the secure default.

Impact

• Ordinary fields can still be exposed when explicitly enabled.
• Sensitive paths remain omitted regardless of the global switch.
• Covers nested and separator variants such as credentials.clientSecret and oauth.access_token.

Checks

• mvn -q -o -pl flyfish-validation-spring-support -am test
• Added regressions for ordinary and sensitive rejected values.