feat(engine): Mask secrets

[daryllimyt]

Changes

• Fix JSONDecodeError in run history
• Add secret masking in udf inputs/outputs
• Add environment variable TRACECAT__UNSAFE_DISABLE_SM_MASKING to toggle masking secrets. We don't expose this in .env.example.

Invariants or non-negotiables

• Any secret values returned by UDFs will be fully masked
  • If you try to use a result that involves a secret value, you will receive the masked value
  • This is intentional, as otherwise we are crossing a security boundary
  • The only secure method of retrieving secrets is using the SM inside an integration or secret expression.