Developers get better handled sensitive data in MS BUILD artifacts

Extracting cut scope from #8400

# Background

Given users ability to indicate sensitive data within their MSBuild scripts and prevent their leakage to logs or possibly other unsecure venues (filesystem, network etc.) via untrusted tasks.
Users might be feeding their MSBuild scripts with sensitive data within the secured/restricted build environemnt (from env, commandline, valuts, etc.), while diagnostic build logs pose a security backdoor mechanism leaking the sensitive data from the restricted environment. Similarly a task can be ill-used to dump/expose the sensitive data.

## Tasks
- [x] https://github.com/dotnet/msbuild/issues/8401
- [ ] #8513
- TBD

# Justification
- Increasing trustworthiness of MSBuild in sealed environments
- Decreasing sensitivity of log files shared by customers