print.mx_client_config(): mask token and password

[TroyHernandez]

An mx_client_config carried no print method, so auto-printing one at
the console fell through to the default list print and showed token and
password in the clear:

$token
[1] "p8TlHVlcHiPjt4sl8tIKE1AFIDeJ4lkZ"

cfg <- mx_client_load(); cfg is the first thing anyone does with this
package, and the credentials then live in scrollback, screenshots, and
pasted bug reports. The on-disk side was already careful (mode 0600); the
in-session side was not.

Now:

<mx_client_config>
  server:            https://matrix.example.org
  password:          <hidden>
  token:             <hidden>
  user_id:           @bot:example.org
  device_id:         DEVICEID
  sync_token:        106398
  path:              /home/user/.config/matrix.json

Notes:

• sync_token is deliberately not masked. It is a cursor, not a secret,
  and seeing it is what you want when debugging a stuck sync.
• access_token and refresh_token are masked too, defensively, in case
  a config picked up those names elsewhere.
• unclass(x) still exposes everything, which is the right escape hatch.
• Set vs empty is distinguishable (<hidden> vs <unset>) so "is my
  token even loaded?" stays answerable without printing it.

Tests assert the secret values appear nowhere in the printed output.
R CMD check is clean apart from the pre-existing stale-Date NOTE.