Hide secrets in logs

# Summary

Currently, the secrets are printed in the logs without any filtering. It would be nice if the secrets could be redacted in the logs while being printed

# Use Cases

This would prevent unintentional leaks of a secret in the log by running something like `env` in the workflow

NOTE: This does not prevent intentionally leaks of the secrets. Someone can still run something like `env | base64` to extract the secrets from the logs, as the filtering will not be able to filter out the secret output.

---

**Message from the maintainers**:

Love this enhancement proposal? Give it a 👍. We prioritise the proposals with the most 👍.

The issue names no files, tests, or entry points. Start by locating where workflow output is emitted and where secrets are available, then define redaction behavior and add coverage showing that secrets printed through commands such as env are hidden while intentionally transformed values are not expected to be filtered.

Written by the indexing model from the issue text.