Capture: redact sensitive values before they enter the trace #503

Part of #494.

Problem

A trace records everything the run showed or typed, credentials included, and there is no redaction anywhere in capture. Measured on the Python login example, its demo credential appears about 103 times across six places in one trace: the page's own text, the DOM mutation stream, Element.fill arguments, the transcript, the captured test source and the element list. Blanking <input type="password"> values covers 2 of those.

A hosted, shareable player makes this matter more, since traces get passed around.

Proposal

A redaction policy applied at capture, in the page collector and the command-argument serializer: for example a maskInputs option and masking selectors, so masked values never enter the archive.