queryservice: sensitive mode: query plan change

query service is going to support sensitive mode where
it will suppress potentially sensitive info when displaying
diagnostics data.
This CL adds a new field to ExecPlan: AnonymizedQuery.
It's an anonymized version of the original query.
queryservice: sensitive mode: alternate approach

The previous approach is causing too many random changes
in the code. The new approach of deciding what the display
query should be upfront should lead to a more robust scheme.
queryservice: sensitive mode flag wiring
queryservice: sensitive mode test
Fix typos
Merge branch 'vtocc'