Mask sensitive values in airflow config update dry-run output

[keith991001]

The dry-run mode of airflow config update (the default mode) printed the full regenerated airflow.cfg to stdout with real values — sql_alchemy_conn, fernet_key, SMTP credentials and every other sensitive option. Since the command is documented as a preview tool for the Airflow 3 config migration, its output easily lands in CI logs, bug reports and support channels, leaking those credentials.

closes: #73255

What changed

• AirflowConfigParser.write_custom_config gains a hide_sensitive parameter: options registered as sensitive (via is_sensitive_option, the same registry airflow config list --hide-sensitive uses) are written as < hidden >. Sensitivity is checked against both the original and the post-rename option name, so a renamed sensitive option stays masked.
• airflow config update dry-run now masks sensitive values by default and prints a hint; a new --show-sensitive flag opts back into real values.
• The --fix path is unchanged: it always writes real values to airflow.cfg, since a masked value would corrupt the config file. This is asserted by a test.

Behavior

$ airflow config update
Dry-run mode enabled. No changes will be written to airflow.cfg.
Sensitive values are shown as '< hidden >'. Use `--show-sensitive` to display them ...
...
sql_alchemy_conn = < hidden >

$ airflow config update --show-sensitive
...
sql_alchemy_conn = postgresql+psycopg2://airflow:S3cr3tPassword@db:5432/airflow

Verified against a real AIRFLOW_HOME with an embedded DB password, plus three new unit tests (masked by default / --show-sensitive reveals / --fix writes real values).

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)

Generated-by: Claude Code (Fable 5) following the guidelines

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.