#[SensitiveParameter] keeps a password out of a stack trace

A stack trace includes argument values, so an exception thrown anywhere below a login method has historically printed the password into a log.

function authenticate(
    string $username,
    #[SensitiveParameter] string $password,
): bool {
    throw new RuntimeException('upstream unavailable');
}

// 8.1:  #0 authenticate('ay', 'hunter2-real-one')
// 8.2:  #0 authenticate('ay', Object(SensitiveParameterValue))

This closes a leak that most applications have and nobody has looked for, because it only appears in a trace from a failure deeper in the call stack — which is exactly the trace that gets pasted into a ticket. It affects the trace only: var_dump on the parameter still prints it, and so does anything logging the argument deliberately. Applying it to every credential, token and card number parameter is a mechanical pass worth doing in one commit.