Add more secret obfuscation strategies

[boardfish]

So far we have true (directly in plaintext) and :alone_as_basic_auth_password (base64 encrypted with a : preceding). There are likely to be more that are important.

[boardfish]

One that's come up is checking a field in the JSON response (e.g. when getting access tokens for a GitHub app using its client ID and secret).