Capture redaction: per-form hidden CSRF tokens stay unredacted in captured HTML #1910

A form's hidden CSRF token (e.g. a per-form authenticity_token) stays unredacted in captured HTML when the page sends a different token. Redact every hidden input whose name matches the token-name pattern (TOKEN_NAME), regardless of whether it was sent. Add a test with two forms carrying different tokens.

Found by the API-step generalization experiment (internal#106); data in #1906 under results/. Fix generically (no app-specific code), fail closed, and add a real-app regression test.