Markup models with confidentiality information

For our database continuous integration tests to start running in
public, we need to ensure that we don't leak confidential information
from test databases to gerrit. The plan here is to anonymize the
contents of the database to eliminate these data leakage issues.

We'd like to keep track of which columns to anonymize along side the
models, because it encourages others to keep the information in sync
when they change the schema. The information is packed into a variable
named __anon__ once per class. It is hoped that this minimizes the run
time impact of this markup, whilst being less confusing than doc
comments.

Change-Id: I93842c6a18a57ccb24f6fe9c8858a1f7ac9bc60e