Partial masking of data in form

## Is your feature request related to a problem? Please describe
Forms may have prefill where it's relevant that part of the data is masked, so people see enough to be certain that the data is correct, but not so much that delicate information is overexposed.

Having this kind of masking in the PDF would also be beneficial - as it would make it possible to store PDFs without storing unnecessary delicate data.

## Describe the solution you'd like
App developer should be able to define masking rules for fields - e.g. for field X mask all characters after the first 6.

## Describe alternatives you've considered
Demand that data is masked from the source of prefill, and that delicate fields are not part of the PDF.

The issue names no files, tests, or entry points. Start by tracing how form prefill data and PDF output are handled, then determine how app-defined field masking rules should be represented and applied; done means sensitive values are partially masked in both form displays and generated PDFs.

Written by the indexing model from the issue text.