Capture request/response bodies in audit-log, extend it to MCP

custom_fields_by_lua adds request_body/response_body to the http-log
payload. Bodies and the raw Authorization header are now both logged
in clear text — dev only, flagged in the plugin file itself.

kong/mcp/audit-log.yaml

@@ -0,0 +1,15 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-catalog-mcp-audit-log
+  namespace: ${NAMESPACE}
+plugin: http-log
+# dev only: request/response bodies and the raw Authorization (JWT) header
+# are captured in clear text. Not acceptable as-is for a non-dev environment.
+config:
+  http_endpoint: ${AUDIT_LOG_ENDPOINT}
+  method: POST
+  content_type: application/json
+  custom_fields_by_lua:
+    request_body: "return kong.request.get_raw_body()"
+    response_body: "return kong.response.get_raw_body()"