Unmask scope and state in url masking

What does this MR do and why?

Relates to #342705 (closed)

The logic for masking personally identifiable information is merged into master. We decided to use the allowlist approach where we mask everything except the declared key which will be left unmasked.

Allowlist approach logic - !73946 (merged)

This MR adds scope and state for leaving them unmasked in url masking logic.

Screenshots or screen recordings

These are strongly recommended to assist reviewers and reduce the time to merge your change.

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.