security: Telemetry.maskString leaves bare password=value and PWD=value unmasked #1457

Found during the v0.12.7 release review's adversarial tests. Deferred: maskString is shared by telemetry and every log line that masks errors, so a change needs its own review. Related: #1287.

password=hunter2          -> password=hunter2   (unmasked)
PWD=hunter2;              -> PWD=hunter2;       (unmasked; ODBC-style connection strings)
pass=hunter2              -> pass=hunter2       (unmasked)
password: "hunter2"       -> password: ?        (masked)
token=sk-ant-api03-…      -> token=sk-***       (masked)

Callers include warehouse-connect connect failed and, new in v0.12.7, reconnect failed (altimate/native/connections/reconnect-log.ts). Snowflake's own auth errors don't quote the password, so no known leak today, but a driver or SDK error that echoes a connection string would be logged as is.

Proposed: mask the value of unquoted (password|passwd|pwd|pass|secret|token)= up to the next ;, &, whitespace or end.