0.9: secrets masked by default

Every key that looks like a secret is masked unless the config says otherwise. Masked changes print a short hash.

Before 0.9, a secret was masked only when mask named it. A key nobody listed printed in full, in a CI log anyone on the team could read.

What changed

Keys ending in _PASSWORD, _TOKEN, _SECRET or _KEY are masked with no config.
A masked change prints the first four characters of a SHA-256 hash, before and after.
unmask in diffkeel.toml opts a key out, by name.

@@ prod.env @@
-PAYMENTS_API_KEY: ******** (a1f3)
+PAYMENTS_API_KEY: ******** (9c07)

$ diffkeel self-update
diffkeel 0.8.2 to 0.9.0

A config that relied on a printed secret now shows a hash instead. Add the key to unmask to print it again.