Do not trace raw credential output

[tyrielv]

Problem

GitProcess.TryGetCredential and GitProcess.TryGetCertificatePassword added the raw stdout of git credential fill to the activity metadata when the parse of that output failed.

git credential fill writes its result as a list of key=value lines:

protocol=https
host=example.com
username=someone
password=<plaintext secret>

The methods compute success from whether the expected values parsed. A helper can return a secret and still fail the parse — for example the username is absent, or the last line has no terminating newline, so ParseValue returns null. On that path the code wrote the entire raw stdout, including the plaintext secret, into the log and into telemetry.

Fix

Trace only the key names that the credential helper returned. A new private helper GetCredentialOutputKeys maps the output to a comma-joined list of key names, and the metadata key changes from Output to OutputKeys. Knowing which keys came back keeps the diagnostic value; the values never leave the process.

Tests

GitProcessCredentialTests covers both methods. Each test makes the parse fail with a distinctive sentinel secret in the output, then asserts that the sentinel is absent from every value in the activity metadata and that OutputKeys lists the expected key names.

MockTracer now records the metadata that is passed to Stop, so tests can inspect what an activity reports.

Verified by mutation: with the redaction reverted, both tests fail on the secret assertion. With the fix in place the unit-test suite is green (919 passed, 0 failed).

Notes

This targets vnext. The defect is long-standing, not a 2.0 regression, and the change alters what the credential path reports at runtime.

Scope is limited to the telemetry leak. The credential routing is not touched.