Exact-match redactor for resolved session secrets.
This redactor is built from a resolved Condukt.Secrets struct and is
intended to be composed with any user-configured redactor. It replaces each
resolved secret value with [REDACTED:NAME], where NAME is the environment
variable exposed to tools.