Auth.net: Mask card number if length == 4 when building credit card XML

In order to use the same card number when updating a payment profile (a
"partial update"), you must send the last-four digits of the card as the
CreditCard#number, masked (e.g. `XXXX11234`).

This change checks if the card number being passed into
`add_credit_card` is 4 digits. If it is, we assume a partial update is
being attempted, and we mask this value in the way Auth.Net expects.

See http://www.authorize.net/support/CIM_XML_guide.pdf, page 70, under
`cardNumber`.