[DSIP-105][Feature][Worker] Mask sensitive parameter values in task logs

### Search before asking

- [x] I had searched in the [issues](https://github.com/apache/dolphinscheduler/issues?q=is%3Aissue) and found no similar feature requirement.

### Description

Subtask of #17937 (DSIP-105). Depends on #18586 (`Property.sensitive` available on runtime params). Does **not** require the encryption subtask.

Dynamically redact this task’s sensitive parameter **plaintext values** from task stdout / agreed task log paths.

#### In scope

- Input: this task’s `prepareParamsMap` (or equivalent context) values where `sensitive=true`
- Behavior: if those values appear in the task log, replace with `******` (extend existing `SensitiveDataConverter` or equivalent with **per-task dynamic** patterns)
- Lifecycle: register at task start; **must clear** on task end (success / failure / kill)
- Must not leak static/global mask state into later unrelated tasks
- Coverage: Physical task execution stdout / task logs; unit tests + log assertions

#### Out of scope

- Project parameters
- Replacing definition-time encryption
- Claiming coverage of every plugin custom log file
- API/UI masking (already #18586)

#### Acceptance

- [ ] Sensitive param values printed by a script do not appear in the task log (shown as `******`)
- [ ] After the task ends (including failure / kill), mask patterns are cleaned up
- [ ] Two tasks in sequence or in parallel do not pollute each other’s logs
- [ ] Unit tests for register / cleanup; concurrent or sequential non-interference

### Use case

After API/UI masking, the remaining common leak is task logs (`echo ${password}`). Operators viewing task logs must not see those secrets.

### Related issues

- Parent DSIP: #17937
- Depends on: #18586

### Are you willing to submit a PR?

- [x] Yes I am willing to submit a PR!

### Code of Conduct

- [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)