A secret field's value can leak into a synthetic aria-label via aria-labelledby #101

Found in the review of the capture-live-form-state branch (live form state + secret redaction).

withResolvedAccessibleName in markanywhere-browse/.../CapturePage.kt copies Blink's computed accessible name into a synthetic aria-label when an element is named only through aria-labelledby.
Per the accessible-name computation, a text box referenced by aria-labelledby contributes its value to that name.

Scenario: <input id="cc" autocomplete="cc-number" aria-labelledby="lbl cc"> holding 4111111111111111.
formControlAttributes drops value and adds data-markanywhere-redacted="filled", but the capture also adds aria-label="Card number 4111111111111111", which simplifyHtml keeps.
Any element whose aria-labelledby points at a masked or cc-* / one-time-code field leaks the same way.
type=password is safe — Blink masks it in the accessibility tree.

Possible fix: when resolving a name, skip it (or strip the referenced value) if any aria-labelledby target is a secret control per isSecretControl; the JS walker has no equivalent today, so the CDP capture is the only place to fix.