Fix data race on OpenStackClient.client and remove internal endpoint from logs

[coderabbitai]

Summary

This issue tracks two security/correctness concerns flagged during review of #10.

---

1. Data race on OpenStackClient.client (High severity)

Severity: High — memory corruption / nondeterministic behavior
Impact: All power-state operations (GetPowerState, SetPowerState) whenever a token refresh occurs

reconnect() mutates c.client without synchronization, while GetPowerState and SetPowerState read the same field. Because controller-runtime invokes Reconcile() concurrently for multiple HostLease objects and all reconciliations share a single managementClient instance, this creates a Go data race. The Go race detector will flag this in production and the behavior is nondeterministic.

Fix direction: Guard c.client with a sync.RWMutex on OpenStackClient: acquire a read lock when copying c.client before use in GetPowerState/SetPowerState, and acquire a write lock when swapping it in reconnect.

---

2. Internal Ironic endpoint hostname exposed in logs

Severity: Low — information disclosure
Impact: Internal service hostnames are emitted to application logs on every reconnect

The reconnect method logs sc.Endpoint (the internal Ironic service URL/hostname). This can expose internal infrastructure topology in log aggregation systems.

Fix direction: Remove the endpoint value from the log statement in reconnect.

---

References

• Flagged in: Add automatic reconnect on Ironic authentication failure #10 (comment: Add automatic reconnect on Ironic authentication failure #10 (comment))
• Prior discussion: Add automatic reconnect on Ironic authentication failure #7 (comment)
• Requested by: @DanNiESh