fix: don't save a masked custom field over the secret it stands for

[blaipr]

A custom field of type password is rendered with value="***" when the viewer lacks
CUSTOMFIELD_VIEW_PASS (aux-customfields.inc), and the browser posts that back verbatim
whenever the form is saved without the field being touched. Nothing on the save path
recognised it, so the mask was encrypted and stored over the real value — which is not
recoverable.

The consequence is not limited to custom field forms. Every item that carries custom
fields goes through this trait, so editing anything at all about an account, user,
client, category, group, profile or auth token destroyed every custom field secret on
it that the editor was not allowed to see. The editor got no indication: the save
succeeded, and the field still showed *** afterwards, because that is what it now
contained.

The rule was already settled here. ConfigLdap, ConfigGeneral and ConfigMail each refuse
the same value on the way in before saving a password, and the mask itself already has
a name — CustomField::MASKED — used by the API adapter that produces it. This applies
it at the door that had never been given it, comparing against that constant rather
than a fourth copy of the literal.

Both paths are guarded, not just the update. A copy is created rather than updated, and
the copy form is prefilled from the original, so a secret the copier may not see arrives
at the create path masked and would become the new item's stored value.

The cost is that a custom field cannot deliberately be set to exactly three asterisks.
That is the trade the three config forms already make.

Checked by removing both guards: all three new tests fail. The first attempt at the
create test did not — it asserted on updateOrCreate, which is the update path's method;
the create path calls create(). It is included as written now, asserting the method that
is actually reached, and the third test pins that the fields either side of a masked one
are still saved, so a guard that dropped everything would not satisfy these.