Refuse a credential in a log entry and take a full 256 KiB value with its expect header (ADR 0297 review)

A log keeps what it is given for good, so the state guard against secrets
applies to it too; the stream holds 260 KiB a message so the headers an
append carries never push a 256 KiB value over.

node-tools/internal/bus/log.go

@@ -57,7 +57,8 @@ type LogInfo struct {
 }
 
 const (
-	// LogValueMax is the most one entry's value may hold (ADR 0297 §3), the stream's own MaxMsgSize.
+	// LogValueMax is the most one entry's value may hold (ADR 0297 §3); the stream's MaxMsgSize is 4 KiB
+	// more, for the headers an append carries.
 	LogValueMax = 256 * 1024
 	// LogKeyMax is the longest key.
 	LogKeyMax = 255
@@ -156,6 +157,11 @@ func (c *Conn) LogAppend(module, name, key string, value json.RawMessage, expect
 		return 0, fmt.Errorf("a log entry's value is at most %d bytes (256 KiB), and this one is %d (novox/hq ADR 0297)",
 			LogValueMax, len(value))
 	}
+	if field := credentialField(value); field != "" {
+		return 0, fmt.Errorf("%s's %s.%s carries a field %q, which names a credential: no secret is kept in a log, "+
+			"which keeps it for good. Name the secret and fetch it on request/reply (novox/hq ADR 0201 §13, ADR 0297)",
+			module, name, key, field)
+	}
 	msg := nats.NewMsg(l.Subject + "." + key)
 	msg.Data = value
 	if expect != nil {