partly address #2120 and more aggressively truncate access_token

- leaking half of the access token to the logs seems problematic from
  a security point of view
- also noisier than necessary logging
- fixed by truncating to at most first 5 chars (e.g. `ya29.`)

Signed-off-by: Martin Nowak <code@dawg.eu>

providers/internal_util.go

@@ -36,7 +36,7 @@ func stripParam(param, endpoint string) string {
 		}
 
 		if val := values.Get(param); val != "" {
-			values.Set(param, val[:(len(val)/2)]+"...")
+			values.Set(param, val[:min(len(val)/2, 5)]+"...")
 			u.RawQuery = values.Encode()
 			return u.String()
 		}