Filter secret values out of the command's output

Why

Version 1 passes the value into the command's environment, but the command may still print it, and the agent then sees it (T15).

nodkey run --mask replaces every fetched value in stdout and stderr with ***, also when a value is split across reads.
Tests with canary values, binary output and a value split across chunks.

feat(run): --mask runs the command as a child and masks its output (r…

docs: nodkey run --mask in the design, the threat model and the setup…

fix(run): --mask lets signals end nodkey after the command, survives …

fix(run): --mask keeps SIGPIPE caught until the output is written, an…

Done in #169 (squash commit 4444bef).

nodkey run --mask replaces every fetched value in stdout and stderr with ***, also when a value is split across reads: internal/client/mask.go (streaming mask writer that holds back only a possible start of a value), internal/client/runmask.go (the command runs as a child; stdout and stderr go through the mask). Documented in DESIGN.md sections 3, 5, 15 and 16, THREAT-MODEL.md T15, and docs/setup.md.
Tests with canary values, binary output and a value split across chunks: internal/client/mask_test.go (TestMaskWriter: canaries, a value split byte by byte and in two; TestMaskWriterBinary: a binary value in binary output, cut at every place), internal/client/runmask_test.go (TestMaskedCommand: canaries through a real sh; TestMaskedCommandSplit: a value written in two writes with a pause; TestMaskedCommandBinary; plus signal, left-behind process, closed output and start failure). CI green on PR feat(run): --mask hides fetched values in the command's output #169.