Function mask_credentials 

pub fn mask_credentials(c: &ConsumerConfig) -> ConsumerConfig

Returns a copy of c with credential secrets replaced by "<masked>".

Every scalar leaf under credentials is masked except the identifying halves of a credential pair (username, access_key), so a read-only viewer can still tell which credential exists without learning it.