Mask access token in migration forms

[silverwind]

Mask the field without the downsides of type=password. It might be argued that there should be a "reveal" button, but this is too tricky to implement and I see that as the job of the browser, and I guess some mobile ones will provide such a button. Also, disable autocomplete so these tokens do not end up in form history.

Fixes: #22174
Fixes: #22175

Firefox:

Chrome:

[silverwind]

Questions:

1. Should the webhook auth header field be included? I'm leaning towards yes but the content there is not only a token. Users might have a hard time inputting the exact header without seeing the typed characters
2. Any other token fields I've missed?

[lunny]

Is this still a draft?

[wxiaoguang]

I know some people like to Copy&Paste non-ASCII chars into the password input, to make their password "more secure". Which is pretty valid.

Then for fun, you will see this with this patch -- which is not a general approach.

[silverwind]

Forgot this PR. Will check out the emoji issue.

[silverwind]

Actually, let's close this in favor of #22175, the firefox workaround is too much of a hack.

Proper solution should be type=password, we just need to figure out how to suppress the browser from offering a "Save Password" prompt. Some other forms like webhook already use type=password and there is no prompt, so it must be possible somehow.