feat(monitors): public heartbeat ping endpoints, header token, log masking and sweeper

deploy/docker/nginx/vantage.conf

@@ -12,6 +12,17 @@ map $http_upgrade $connection_upgrade {
     ''      close;
 }
 
+# Heartbeat ping URLs carry a credential. Log them with the token replaced;
+# the header form (X-Vantage-Token) is never logged by this format.
+map $request_uri $vantage_log_uri {
+    "~^/public/hb/(?!start(?:[/?]|$)|fail(?:[/?]|$))[^/?]+(?<hb_rest>.*)$" "/public/hb/***$hb_rest";
+    default $request_uri;
+}
+
+log_format vantage '$remote_addr - $remote_user [$time_local] '
+                   '"$request_method $vantage_log_uri $server_protocol" '
+                   '$status $body_bytes_sent "$http_referer" "$http_user_agent"';
+
 upstream vantage_server {
     server server:8080;
     keepalive 16;
@@ -27,6 +38,8 @@ server {
     listen [::]:80;
     server_name _;
 
+    access_log /var/log/nginx/access.log vantage;
+
     # Step imports and licence pastes are the largest request bodies.
     client_max_body_size 10m;