Share the text-security masking check between the two captures #104

Found in the review of the capture-live-form-state branch.

"Is this field masked?" is decided twice: it != null && it != "none" in CapturePage.kt (SnapshotDom.formState) and !isNullOrEmpty() && != "none" in ElementToSemanticEvents.kt (isMasked).
They already disagree on an empty string, and it is the kind of drift the new CLAUDE.md entry warns about (content decisions belong in one function both producers call).

Fix: add e.g. public fun isMaskingTextSecurity(value: String?): Boolean to FormControls.kt and call it from both.