pub fn is_secure_control(control: &str) -> bool
True when a control type / field descriptor names a password or secure input. Pure + case-insensitive so it is unit-testable without UIA.