DownloadManager: document redact_url kwarg

[bitcoin3us]

Summary

Companion to MicroPythonOS#136 which adds a redact_url=False kwarg to DownloadManager.download_url. This documents:

• The new kwarg in the parameters table
• A new "Redacting Sensitive URLs" section covering when callers should opt in, what gets redacted (URL path/query, response headers, exception messages — host kept for failure triage), and why the default is False
• Common cases that benefit from redact_url=True: API-key-in-URL, OAuth-token-in-URL, wallet xpubs in indexer URLs, LNBits readkey paths

Why

Motivating case in the wild: LightningPiggyApp PR #25/#26 on-chain wallet queries Blockbook with the xpub in the URL path. The Lightning Piggy app scrubs xpubs from its own logs, but DownloadManager's built-in URL logging was re-leaking the xpub on every poll. The kwarg gives callers a clean opt-in to hide the secret-bearing portion.

Test plan

• Markdown renders correctly (only the parameters table + one new section added; existing content unchanged)
• Docs site preview: confirm the new "Redacting Sensitive URLs" anchor renders and the table-of-contents picks it up
• Once MicroPythonOS#136 merges, verify the example code blocks here match the shipped signature