Context

Follow-up to PYTHON-5928 / PR #2803 (https://github.com/mongodb/mongo-python-driver/pull/2803).

Credentials are also carried by namedtuples that have default {{repr}}s and could leak the same secrets if ever interpolated into an error message or log line:

• MongoCredential (pymongo/auth_shared.py:75) — has a mechanism_properties field
  GSSAPIProperties (pymongo/auth_shared.py:82)
• _AWSProperties (pymongo/auth_shared.py:88) — holds aws_session_token

No current logging/error path was found that renders these directly, so this is defense-in-depth rather than a confirmed active leak.

Definition of done

• Audit all paths that render or log credential objects / authMechanismProperties (error messages, LOGGER calls, monitoring, repr/str of credential namedtuples).
• Ensure any such path reuses the shared redaction helper (or an equivalent) so secrets are not exposed.
• Add regression tests covering any newly-identified rendering path.
• The redaction helper already exists and uses a safe-property allowlist; prefer reusing it over duplicating logic.

Pitfalls

NA