test(vcr): automatically redact bearer tokens

spec/support/vcr.rb

@@ -4,4 +4,13 @@ VCR.configure do |c|
   c.cassette_library_dir = 'spec/fixtures/cassettes'
   c.configure_rspec_metadata!
   c.ignore_hosts 'test.host', 'chromedriver.storage.googleapis.com'
+
+  c.filter_sensitive_data('redacted') do |interaction|
+    auth = interaction.request.headers['Authorization']&.first
+    next if auth.nil?
+
+    if (match = auth.match(/^Bearer\s+([^,\s]+)/))
+      match.captures.first
+    end
+  end
 end