Mask protected fields by default and add --print-protected-fields flag

[aivanovski]

Motivation

• Prevent leaking sensitive/protected values (passwords) in diff output by default.
• Provide an explicit opt-in flag so users can request printing protected values when required.

Description

• Mask protected field values by default in formatter output by replacing password values with the placeholder "***" in DiffFormatterImpl via a new maskProtectedFields helper.
• Add CLI options --print-protected-fields and --print-passwords in OptionalArgument and wire them through ArgumentParser into the parsed Arguments and MutableArguments.
• Propagate the new option into runtime formatting via DiffFormatterOptions and MainInteractor so stdout formatting respects the opt-in.
• Update help text in PrintHelpUseCase and adjust unit tests (DiffFormatterImplTest, ArgumentParserTest, MainInteractorTest, GetKeysUseCaseTest, and related helpers) to cover default masking and explicit opt-in behavior.

Testing

• Ran git diff --check which produced no warnings.
• Attempted to run the full test suite with Gradle: ./gradlew test --stacktrace failed under the environment default Java (25.0.2) due to Kotlin Gradle tooling incompatibility, and JAVA_HOME=/root/.local/share/mise/installs/java/17.0.2 ./gradlew test --offline failed due to plugin resolution not available in the offline/local cache; no project unit tests were able to complete in this environment.
• Updated unit test expectations to assert masked output by default and restored values when isPrintProtectedFields is enabled; these tests were modified but could not be executed fully here due to the Gradle/tooling issues described above.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1e12d96bc3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Honor protected-field flag for file output

When --output-file is set, execution takes the writeDiffUseCase.writeDiff branch above and skips this options block, so parsedArgs.isPrintProtectedFields is never forwarded to WriteDiffToFileUseCase (which creates DiffFormatterOptions with the default false). As a result, kp-diff --output-file out --print-protected-fields ... still writes masked passwords even though the new flag requests unmasked protected values.

Useful? React with 👍 / 👎.