Secret fields should be identified as such

[displague]

Secret fields should be identified as such.

code.setSecret('...') should be applied on metal_auth_token and perhaps user_data to prevent leaking secrets in GH Action job logs.

https://github.com/actions/toolkit/blob/main/packages/core/README.md#setting-a-secret

[cprivitere]

Should also add the registration token to that. In the current testing I'm doing, those are stored as secrets so they're getting masked already. I should try inputting them differently for testing.