fix: hide masked values in log files (#1011)

this commit adds support for the `::add-mask::` command, which was
implemented as a stub before.

it does not cover debug output that appears when you run act in
verbose mode

Co-authored-by: Björn Brauer <bjoern.brauer@new-work.se>
Co-authored-by: Markus Wolf <markus.wolf@new-work.se>

Co-authored-by: Björn Brauer <bjoern.brauer@new-work.se>
Co-authored-by: Markus Wolf <markus.wolf@new-work.se>

pkg/runner/step_context.go

@@ -671,6 +671,8 @@ func (sc *StepContext) execAsComposite(ctx context.Context, step *model.Step, _
 			"name": outputName,
 		}, eval.Interpolate(output.Value))
 	}
+
+	backup.Masks = append(backup.Masks, compositerc.Masks...)
 	// Test if evaluated parent env was altered by this composite step
 	// Known Issues:
 	// - you try to set an env variable to the same value as a scoped step env, will be discared