Implement more configuration options

Summary:
Allow extra options to be locked, hidden or masked via config. These options are themselves locked and can not be edited via the web UI.

The primary goal here is to let us lock or hide things from SaaS installs (e.g., keys, etc.), or to let server administrators lock or hide information from web UI administrators if they want to for some reason.

The secondary goal is to remove the darkconsole.config-mask option, although I might just remove the panel entirely and put it in the config app, since that probably makes far more sense. Yeahhhhh... probably doing that.

These options need masks when ported (they haven't been ported yet):

phabricator.csrf-key
phabricator.mail-key
security.hmac-key

Test Plan: Artifically tweaked lock/hide settings on options, verified the UI respected them.

Reviewers: codeblock, btrahan

Reviewed By: codeblock

CC: aran

Maniphest Tasks: T2255

Differential Revision: https://secure.phabricator.com/D4472