SanitizePasswordsProcessor removes API keys

Minor change to `SanitizePasswordsProcessor` in order to sanitize keys matching `api_key` or `apikey`.

I've refactored tests to reuse a `VARS` module-level variable and deduplicate some assertions with a `_check_vars_sanitized` helper method.