What is the best practice for debugging callouts and their endpoints that are stored in custom metadata or custom settings? What are the possible threats and security risks if adding this sensitive information into your debug logs?
Debug logs in apex code should not contain any sensitive data (usernames, passwords, names, contact information, opportunity information, PII, etc). The debug logs include standard salesforce logs using system.debug() methods or custom debug logs created by the application. Sensitive information should also be not be sent to 3rd party by emails or other means as part of reporting possible errors.
Realistically, the threats and risks are relatively minimal. Only administrators (those with View All Data) can do anything with those logs at all, so as long as the proper users have proper permission, there shouldn't be any major threats to worry about.
That said, debugging this information is still a risk if you need to allow outside support/access to your org (including Technical Support and/or ISVs who log in to support their apps). Likewise, ISVs should not debug credentials, because they could accidentally be leaked to an administrator in the subscriber org.
When in doubt, simply don't do it. There's no reason you need to debug user credentials to the logs (if so, your app doesn't have proper access logs!).
Your logging should be robust enough to explain the problem without exposing these details. Log the status code, status text, and a redacted response body (if necessary) to trace the problem, and use the logs of the remote service to get more information, if necessary.