RFE: Redact secret keys in logfiles

NPM allows for automatic cert renewal with LetsEncrypt, given proper credentials. It's made clear that these credentials will be stored in plaintext (and there is good reason for this). However, there isn't any real reason in my mind that the keys can't be redacted from the logfiles. In many setups, these logs are ingested by other monitoring solutions, so redaction would reduce exposure by quite a bit.

For instance, the Route53 access key wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY could instead appear in the logs as shown below. Enough information to figure out which key it is, but not enough information for another party to derive the key itself (or key length). This change should have no impact on the renewal functionality of NPM itself.

proxy  | [1/29/2025] [9:00:00 PM] [Global   ] › ⬤  debug     CMD: [ -f '/etc/letsencrypt/credentials/credentials-7' ] || { mkdir -p /etc/letsencrypt/credentials 2> /dev/null; echo '[default]
proxy  | aws_access_key_id=AKI***PLE
proxy  | aws_secret_access_key=wJa***KEY' > '/etc/letsencrypt/credentials/credentials-7' && chmod 600 '/etc/letsencrypt/credentials/credentials-7'; }

No file or test is named. Trace the code that builds the Let's Encrypt credential command and emits it to logs, then inspect how credentials are handled for other providers. Done means secret keys are consistently redacted in log output without changing certificate renewal behavior; add or update coverage where the logging path is tested.