@W-22567720: remove sensitive output

[iowillhoit]

What does this PR do?

• Redacts accessToken, refreshToken, clientSecret, and password from JSON output of all login commands (sf org login jwt, sf org login web, sf org login sfdx-url, sf org login access-token)
• Redacts accessToken from sf org list auth --json output
• Adds SF_TEMP_SHOW_SECRETS=true env var as a temporary workaround for CI pipelines
• Updates sfdxurl.store.md help text to reference sf org auth show-sfdx-auth-url instead of sf org display --verbose
• Adds shared redactAuthFields() utility in common.ts

Related

• @W-22438536 Auth commands plugin-org#1667
• @W-22439379: remove secrets plugin-org#1673

Test plan

• sf org login jwt --json no longer shows accessToken
• sf org login web --json same
• sf org login sfdx-url --json same
• sf org login access-token --json same
• sf org list auth --json no longer shows accessToken
• SF_TEMP_SHOW_SECRETS=true restores original values with deprecation warning
• HRO output unchanged (only shows success message, no secret)
• Unit tests pass: yarn test

What issues does this PR fix or reference?

@W-22567720@