Add ENV hook to control whether stderr is sent to diag().

For xt/mask_password.t, we must run in verbose mode, but
we don't want the output sent to diag(), which is what
we do for other tests because it usually means that something
went wrong.
Add function to mask passwords.

Assuming that all output and log messages (from cpanm) will
go through one of these methods, we santize things that look
like the password in a url from all messages.  For example:
http://user:password@foo.com.

I chose to use "*password*" as the mask because that is what
wget uses (or curl, I forget which).

When using wget or curl for the backend, they will emit their
own stuff to STDIN or STDOUT.  We can't easily sanitize that,
but I trust that they will not leak the password either.
Make positive assertion that the mirror URL is even present.