GHSA-c3mw-737p-c7g2: Jupyter Server: 5xx request logging leaks token-bearing Referer header values

### Summary When a request returns a 500, `jupyter_server/log.py` logs a small JSON block of request headers. The Referer header was copied into it as-is, so a token in the Referer URL ended up in the logs in plain text. ### Impact Anyone who can read the server logs can pick tokens out of these 500 entries. Tokens end up in the Referer during normal token-based login and launch flows. Affected: all versions before 2.21.0. …