Feature Request: Mask secret in the output of `git secrets` command

The command `git secrets` outputs the secrets, so it is difficult to use this in CI because the secrets are leaked as the CI log.

```
$ git secrets --scan -r .
./foo.txt:8: AWS_ACCESS_KEY_ID: *** # the secret is outputted!
...
```

So how about adding the option to mask secrets in the output?

Thank you.

Start by running the shown `git secrets --scan -r .` command and tracing where its findings are formatted. Define the masking option's expected output, preserving enough file and line context for CI users while preventing the matched secret from appearing in logs; the issue does not name implementation files or tests.

Written by the indexing model from the issue text.