Don't show debconf passwords

Debconf options have a specific type for password, which prevents
revealing them by accident (readable only to root, stored separately,
marked explicitly as passwords). Salt shouldn't leave those values
available either. This applies to log files, console output, etc.