p2.5: log host=- for permit_restricted callers

Scrape, fetch, refused, fetch-failed, and internal lines redact the
host for callers in context.permit_restricted. final_url stays in the
response. Test captures slog records, not the journal.

cmd/sift/serve.go

@@ -96,6 +96,7 @@ func serveMain() {
 	defer stop()
 
 	srv := api.New(version, g, fetcher, store, log)
+	srv.PermitRestricted = cfg.Context.PermitRestricted
 	if cfg.Dixie.Chat != "" {
 		cachePath := cfg.Digest.Cache
 		if cachePath == "" {