Mask URI passwords in output (alternate approach)

This is an alternate implementation of #261.

I have kept @thaljef's tests, but squashed them into a single commit.

I renamed his masking method and dropped his changes to chat/diag, but otherwise gave him credit for the commit.

Then I implemented a targeted masking function only for output calls where we know we have a URI.  It calls the same original method after masking any strings passed to it.

I considered masking each individual URI, but decided that littering the strings with `@{[ $self->mask_uri_password( ... ) ]}` was ugly and painful.