Mask environment variable values in logs

[hawkeyexl]

Environment variables are most commonly used to temporarily store secrets, but today Doc Detective emits all resolved values in logs, including those that come from environment variables. This is particularly problematic when typing sensitive values like usernames and passwords that shouldn't be displayed as plaintext.

While there is a workaround to use the GitHub Action to leverage GitHub's native environment variable masking, we still need to support this natively.

This behavior is most important to typing, but it also applies to API keys and other secrets, so it should really be supported globally. That said, sometimes it's useful to know exactly which values were fetched, like with URLs, so maybe there should be some sort of visibility setting? Some way to distinguish between a variable and a secret?

cc @JakeSCahill