Galera4 refactor removed the MDEV-10564 credential-statement redaction, so wsrep error logging emits raw CREATE USER/GRANT/SET PASSWORD text

MDEV-10564 added `wsrep_get_query_or_msg()`, which mapped `SQLCOM_CREATE_USER`, `SQLCOM_GRANT`,
`SQLCOM_REVOKE` and `SQLCOM_SET_OPTION`/`SET PASSWORD` to a statement name before logging, so
credential statements were not written verbatim. That helper was removed in the Galera4 refactor
*`36a2a185fe1`*, and HEAD now logs the raw `thd->query()` at two sites:

• `sql/wsrep_mysqld.cc:3178` — `WSREP_INFO(... thd->query())` when a local TOI client transaction is
  BF-aborted (`s_must_abort`).
• `sql/wsrep_mysqld.cc:3913` — `WSREP_WARN(... thd->query())` on ignored apply errors.

Neighbouring log sites use `wsrep_thd_query()`/masked text, but these two take the unmasked query.
`WSREP_INFO`/`WSREP_WARN` are forwarded to the server error log, so a `CREATE USER ... IDENTIFIED BY`,
`GRANT`, or `SET PASSWORD` statement that hits the conflict/abort path can be written to the error
log (and from there to a SIEM) with the credential text.

1. 1. Expected result

Credential-bearing statements (CREATE USER / GRANT / REVOKE / SET PASSWORD) must not be logged
verbatim; the redaction behaviour from MDEV-10564 should be restored for all `thd->query()` log
sites in `sql/wsrep_mysqld.cc` (`:3178`, `:3913`, and any other raw-query log call).