Fixes #5926 - hide sensitive parameter values

User can check to hide value when creating or editing global parameter.
The value is masked by *** and is also not displayed when overriding.

This is meant as short-term solution. Long-term we should move to smart variables and smart class parameters and add proper password support there. I know that similar patch would be handy for smart variables and smart class parameters, but it seems too much work which would be dropped later.
imho, pass an attribute that its safe, and then let JS add the ******