harden: debug mode logs only a request's origin and JSON-RPC method (closes #410)

With debug mode on, debugFetch logged every request's full URL and body,
so an RPC endpoint with an API key in its path or query string printed
that key to the console on every request. It now logs the HTTP method,
the URL's origin and, for a JSON-RPC body, the method name. The balance
refresh and token lookup, which logged the RPC URL at debug level, log
its origin too. The README's DEBUG Mode Policy says what debug mode logs.

Model: opus-5-5

tests/symbolSpoof.test.js

@@ -44,6 +44,7 @@ jest.mock("../src/shared/log", () => ({
         errorf: () => {},
     },
     debugFetch: jest.fn(),
+    urlOrigin: () => "",
     setRuntimeDebug: () => {},
     isDebug: () => false,
 }));