Token-prefix masking hides the prefix instead of only the token body

Problem

Token-prefix masking in streamer/sanitizer replaced the whole match including the prefix (glpat-abc… → [MASKED]).

This differs from GitLab Runner's masker, which keeps the prefix visible (glpat-abc… → glpat-[MASKED]), so logs stay readable while the secret body is still hidden.

Expected behavior

Mask only the token body and keep the prefix (glpat-abc… → glpat-[MASKED]), matching GitLab Runner's long-standing behavior. This can reuse the callback already used for URL-parameter masking, which keeps the matched key in place.