Optional reference handler for Phase 21 scheduled metadata refresh
telemetry. Emits one redaction-aware Logger line per documented
[:relyra, :saml, :metadata, :auto_refresh, ...] event.
Per D-30: NOT default-attached. Adopters opt in by calling
attach/0 from their Application.start/2. Removes the "what do I
do with these events?" friction without coupling Relyra to any
vendor (Slack / PagerDuty / Sentry remain host-app territory).
Drops sensitive keys (:xml, :metadata_xml, :certificate_pem,
:pem, :private_key) before the Logger formatter sees them — same
posture as Relyra.Log.