Function mask 

pub fn mask(input: &str) -> String

Mask all known secret patterns in input.

Idempotent: running twice produces the same output (the replacement [REDACTED:<kind>] contains no characters that match any pattern).