* Introduce a config module to manage configuration

* Remove public modifier

* Introduce a config module to manage configuration

* Remove public modifier

Fix 8 CodeQL security alerts in files we modified during development:

**Regex Vulnerabilities (Alerts QwenLM#25, QwenLM#17)**
- loopDetectionService.ts:309,314: Fix character class ranges by placing
  hyphens at start (e.g., [-+|] instead of [|+-])
- shell.ts:354: Replace ReDoS-vulnerable pattern with unrolled loop pattern
  for git commit message extraction (prevents exponential backtracking)

**URL Sanitization (Alerts QwenLM#24, QwenLM#9, QwenLM#30)**
- deepseek.ts:25: Use URL.hostname instead of includes() to prevent bypass
  (e.g., evil.com/api.deepseek.com would have passed)
- web-fetch.ts:63: Use URL.hostname for GitHub URL detection
- coreToolScheduler.ts:30 (fixed by user in da5759c)

**Clear-text Logging (Alerts QwenLM#23, QwenLM#22, QwenLM#21, QwenLM#20, QwenLM#19, QwenLM#18)**
- errors.ts: Add sanitizeSensitiveData() function to redact API keys, tokens,
  passwords, and OAuth codes from error messages before logging
- errors.ts:112,115: Sanitize all console.error outputs
- validateNonInterActiveAuth.ts:69: Sanitize error messages before logging
- index.ts:21,26,28: Sanitize FatalError messages and stack traces

Security Impact:
- Prevents ReDoS attacks via malicious git commit messages
- Blocks URL validation bypass attempts
- Protects API keys/tokens from appearing in logs

All fixes maintain backward compatibility and existing functionality.

Resolves CodeQL alerts: QwenLM#25, QwenLM#24, QwenLM#23, QwenLM#22, QwenLM#21, QwenLM#20, QwenLM#19, QwenLM#18, QwenLM#17, QwenLM#9

…ging alerts

Replace detailed error logging with generic messages in index.ts and errors.ts
to prevent exposure of potentially sensitive information.

Changes:
- index.ts: Remove error.message extraction and logging
  Replace with static "An error occurred during execution." message
  Remove unused sanitizeSensitiveData import

- errors.ts: Remove parseAndFormatApiError() calls and import
  Stop logging formatted error details that could contain credentials
  Use generic Error objects for all logging

This completely eliminates taint analysis paths from sensitive data sources
(FORA_OAUTH, API keys, environment variables) to console.error sinks.

Resolves CodeQL alerts: QwenLM#18, QwenLM#19, QwenLM#20 (index.ts) and QwenLM#21, QwenLM#22 (errors.ts)

Trade-off: Users will see generic error messages instead of detailed ones,
but this prevents credential exposure. Debug mode can be enabled for
detailed error information in development environments.

* Introduce a config module to manage configuration

* Remove public modifier