fix(proxy): don't expose upstream exception detail in passthrough 502

The RemoteProtocolError handler added for the #1112 transient-retry fix
interpolated the raw httpx exception into the JSON error message returned
to the external client, so upstream stack-trace/exception text could leak
to callers (CodeQL py/stack-trace-exposure, alert #136 at openai.py:6341).

Keep the full exception in the server-side logger.warning (unchanged) and
return a generic "upstream closed the connection without sending a complete
response" message with the same 502 status. Only the flagged path is
touched; behaviour and the existing 502 contract are otherwise unchanged.

Author: gaurav0107

headroom/proxy/handlers/openai.py

@@ -6486,9 +6486,13 @@ async def handle_passthrough(
                     {
                         "error": {
                             "type": "upstream_protocol_error",
+                            # Full exception detail is logged server-side above;
+                            # keep the client-facing message generic so upstream
+                            # exception/stack-trace text is not exposed (CodeQL
+                            # py/stack-trace-exposure).
                             "message": (
                                 "Upstream closed the connection without sending "
-                                f"a complete response: {e}"
+                                "a complete response."
                             ),
                         }
                     }