Get passwords out of the logs

[yaronyg]

When we run commands as child processes we pass passwords in on the command lines we submit. In and of itself that isn't bad because these are temporary environments, there is no history or other record. But when we log the commands we include the full command line arguments which includes (wait for it) passwords! So we need to extend our command infrastructure to tell them which arguments have passwords as values and to not store them.