feat: add account script step coverage (Batch 1)

[petrowsky]

Summary

Resolves the remaining ⚠️ NOT PARSED ⚠️ warnings for account script steps and
adds a --obfuscate-passwords CLI flag for sanitized output.

New enum variants (constants.rs):

• ChangePassword = 83
• AddAccount = 134
• DeleteAccount = 135
• ResetAccountPassword = 136
• EnableAccount = 137
• ReLogin = 138

New dedicated sanitizers (accounts.rs):

All six account steps are implemented in a single accounts.rs module with
per-step sanitizer functions rather than one file per step. Each function
produces output matching the FileMaker Script Workspace label/format exactly:

Step	Key formatting
Add Account	Authenticate via:, Account Name:, Password:, Privilege Set:, conditional Expire password
Change Password	Old Password:, Password:, With dialog: On|Off
Delete Account	Account Name:
Enable Account	Account Name:, Activate or Deactivate
Re-Login	Account Name:, Password:, With dialog: (DataSourceReference omitted; params reordered from SaXML)
Reset Account Password	empty [], or Account Name:, Password:, conditional Expire password

New parameter parser (privilege_set_reference.rs):

• Reads <PrivilegeSetReference name="..."> with XML-entity unescaping
• Handles both known sets ([Data Entry Only]) and unknown (<unknown>)

Extended parameter dispatch (parameter_values.rs):

• AccountType → reuses List parser (inner <List name="...">)
• Password, Old, New → extended named-calc arm (same as Name, Title, etc.)
• PrivilegeSetReference → new parser above

New CLI flag (--obfuscate-passwords):

• Replaces any password calculation value with •••••••• in sanitized output
• Implemented via calc_or_obfuscated() helper in accounts.rs: returns None
  when no calculation is present, •••••••• when the flag is set and a
  calculation exists, or the real value otherwise
• Threaded through config::Flags → script_sanitizer → sanitizer → account
  sanitizer functions

Before / after (Ooe — Accounts script):

Before: Add Account [ ⚠️ PARAMETER "AccountType" NOT PARSED ⚠️ ; ⚠️ PARAMETER "PrivilegeSetReference" NOT PARSED ⚠️ ; Expire password: OFF ]
After:  Add Account [ Authenticate via: FileMaker ; Account Name: <unknown> ; Privilege Set: <unknown> ; Expire password ]

Before: Change Password [ ⚠️ PARAMETER "Old" NOT PARSED ⚠️ ; ⚠️ PARAMETER "New" NOT PARSED ⚠️ ; With dialog: ON ]
After:  Change Password [ Old Password: $old ; Password: $new ; With dialog: On ]

All unit + snapshot tests pass. cargo fmt and cargo clippy -Dwarnings clean.

Fixes #28

[petrowsky]

If you pull the PR and look at the code you'll probably need to make a decision about whether you want to obfuscate the raw XML as well.

Also, the shared function for obfuscating is within accounts.rs. This might need to be moved to utils so that it could be used for steps like Send Email where you would also want to obfuscate the passwords there.

It's also an architectural decision if you want each step to be it's own file. Using an agent, it just shoved all these into the one accounts.rs file.

[petrowsky]

Looks like we could also add a few more of the default items to privilege_set_reference.rs