fix: Mask a phrase that restarts in a flushed prefix (closes #39933)

What does this MR do?

Make the secret masker fall back through the phrase's KMP prefix function on a mismatch. The bytes that can no longer begin a match are flushed, the longest still-valid partial match is kept, and the mismatching byte is retried against it.

Closes #39933

Before and after

Before: When a partial phrase match broke across a Write boundary, the masker flushed the whole matched prefix and retried only at the first byte of the next chunk. An occurrence starting at an interior byte of that prefix was skipped, so the secret reached the log unmasked (phrase "aab" over writes "xxaa" and "ab" came out as "xxaaab").

After: The same input is masked correctly, because the occurrence that starts inside the flushed prefix is caught.

How to validate locally

1. Run go test ./common/buildlogger/internal/masker/....
2. Confirm the new restart cases in masker_test.go pass.

Acceptance checklist

• A phrase restarting inside a flushed prefix is masked
• Existing masker behaviour is unchanged
• Tests cover the restart cases