support config rules for masking fields

when showing diffs (--diff-changes) some users want to be able to mask values of Secrets (v1/Secret). let's add diffFieldMaskRules to config:

```yaml
apiVersion: kapp.k14s.io/v1alpha1
kind: Config

diffFieldMaskRules:
- path: [data]
resourceMatchers:
- apiVersionKindMatcher:
apiVersion: v1
kind: Secret
```