Capture request/response bodies in audit-log, extend it to MCP

custom_fields_by_lua adds request_body/response_body to the http-log
payload. Bodies and the raw Authorization header are now both logged
in clear text — dev only, flagged in the plugin file itself.

kong/kustomization.yaml

@@ -15,4 +15,5 @@ resources:
   - mcp/consumergroups.yaml
   - mcp/ai-mcp-proxy.yaml
   - mcp/openid-connect.yaml
+  - mcp/audit-log.yaml
   - mcp/pluginbindings.yaml