mask keys by default when checking API key expiry

the `collectoss github api-keys` CLI output prints the full api key each time. This isnt great for preventing shoulder surfing.

I think we should make use of the existing `mask_key` helper function that we have to mask the keys unless a --show-keys command line flag is supplied to the command indicating that the full key should be shown.

Start with the `collectoss github api-keys` CLI command and locate the existing `mask_key` helper. Make the command mask keys by default, accept `--show-keys` for full values, and verify both output modes and the existing expiry-check behavior.

Written by the indexing model from the issue text.