fix(authz): widen logSafe to strip NEL and Unicode line separators

U+0085 (NEL), U+2028 (LINE SEPARATOR), and U+2029 (PARAGRAPH SEPARATOR)
are treated as line terminators by some log shippers and by JS's own
lexical grammar (and are not escaped by JSON.stringify by default), so
they could still be used to forge audit log entries even after the
initial C0/DEL fix. logSafe now strips all five categories.

packages/authz/src/audit.ts

@@ -38,7 +38,11 @@ function logSafe(value: string): string {
   let out = "";
   for (const character of value) {
     const code = character.codePointAt(0)!;
-    out += code < 0x20 || code === 0x7f ? " " : character;
+    // C0 + DEL, plus NEL and the Unicode line/paragraph separators, which some
+    // log shippers and JSON consumers also treat as line terminators.
+    const isLineBreaking =
+      code < 0x20 || code === 0x7f || code === 0x85 || code === 0x2028 || code === 0x2029;
+    out += isLineBreaking ? " " : character;
   }
   return out;
 }