Auth.net: Mask card number if length == 4 when building credit card XML

In order to use the same card number when updating a payment profile (a "partial update"), you must send the last-four digits of the card as the CreditCard#number, masked (e.g. `XXXX11234`).

This change checks if the card number being passed into `add_credit_card` is 4 digits. If it is, we assume a partial update is being attempted, and we mask this value in the way Auth.Net expects.

See http://www.authorize.net/support/CIM_XML_guide.pdf, page 70, under `cardNumber`.