Function filter_sensitive_env 

pub fn filter_sensitive_env(
    env: &HashMap<String, String>,
) -> HashMap<String, String>

Filter sensitive environment variables from an existing map.

Less aggressive than build_sanitized_env - preserves most vars but removes known sensitive ones.