Markup models with confidentiality information

For our database continuous integration tests to start running in
public, we need to ensure that we don't leak confidential information
from test databases to gerrit. The plan here is to anonymize the
contents of the database to eliminate these data leakage issues.

We'd like to keep track of which columns to anonymize along side the
models, because it encourages others to keep the information in sync
when they change the schema. The information is packed in "doc
comments", because that's the best way we could think of to minimize
the impact of our markup.

Change-Id: I93842c6a18a57ccb24f6fe9c8858a1f7ac9bc60e