Keep the token out of the debug output

[cjbarth]

The bug

--debug prints the whole options object, and token is one of the options, so the
credential is written to stdout in full:

Options:
...
Token: ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Data source: prs

--debug is the first thing anyone turns on when a run misbehaves, and a run that
misbehaves is usually one in CI. A build log is not a private place to keep a token that
can write to the repository.

The fix

Report that the token is set, not what it is: Token: <hidden>. Every other option is
still printed, since that is what the output is for. _outputOptions is the only place in
lib/ that prints the token.

One line beyond the strict fix, flagged for review: the filter in the same expression
compared each [key, value] entry against the string "debug", so it never matched and
--debug reported itself. It now destructures the key. Happy to split this out if you
would rather keep the PR to the redaction alone.

Verification

The test was written first and failed for the reported reason
(expected '\nOptions: \nTags: all\nPrefix: empty…' to not include 'ghp_averysecrettoken').

Real run of gren changelog --generate --override --debug against this repository,
writing to a scratch file, counting occurrences of the actual GREN_GITHUB_TOKEN value in
the output:

--- master ---
  token value appears: 1
  Debug: true
  Token: <the real token>
  options still listed: 29 lines
--- this branch ---
  token value appears: 0
  Token: <hidden>
  options still listed: 28 lines

The 28 vs 29 is the Debug: line the filter now removes.

npm test 132 passing; env -u GREN_GITHUB_TOKEN npx mocha 93 passing, 39 pending;
npm run lint clean apart from the pre-existing mocha/no-pending-tests warning in
test/Gren.spec.js.

Worth doing separately

Any token that has been through a --debug run in a shared log should be rotated. This
change stops new leaks; it cannot recall old ones.

🤖 Generated with Claude Code