Function mask_secrets 

pub fn mask_secrets(input: &str) -> String

Mask known secret patterns in a string in a single pass.

Handles Bearer/Basic auth headers (case-insensitive), sk-* API keys, AWS keys (AKIA...), GitHub tokens (ghp_/gho_/ghs_/ghu_), and password=, token=, key=, secret=, api_key=, apikey=, access_token=, private_key= values. All occurrences are masked.