ensure passwords are redacted with registry-auth

[crazy-max]

This is just for extra safety. It should not matter as secrets passed to password attribute in registry-auth YAML object are already redacted.

[tonistiigi]

@crazy-max Just a reminder that in some cases masking too many things as secret can leak the variable. Eg. if you see *** build -f ***file . then someone is using docker as a password.

[crazy-max]

@crazy-max Just a reminder that in some cases masking too many things as secret can leak the variable. Eg. if you see *** build -f ***file . then someone is using docker as a password.

Yes true, that's why we switched from secrets to vars for username in our docs: https://github.com/docker/login-action?tab=readme-ov-file#usage