ci: mask fetched Permit API key so it is not logged in cleartext

The Fetch API_KEY step wrote the env api key to $GITHUB_ENV and echoed it
directly, so it appeared in cleartext in the run logs and in the env-group
dump of every later step. Register the value with ::add-mask:: before
exporting it, and drop the explicit echo, so it is redacted everywhere.

PROJECT_API_KEY should still be rotated since it was exposed in prior runs.

Fixes PER-15241.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: dshoen619

.github/workflows/node_sdk_publish.yaml

@@ -61,10 +61,12 @@ jobs:
             https://api.permit.io/v2/api-key/${{ env.PROJECT_ID }}/${{ env.ENV_ID }} \
             -H 'Authorization: Bearer ${{ secrets.PROJECT_API_KEY }}')
 
-          # Extract the secret from the response which is the API_KEY of the new env
-          echo "ENV_API_KEY=$(echo "$response" | jq -r '.secret')" >> $GITHUB_ENV
-
-          echo "New env api key: $ENV_API_KEY"
+          # Extract the api key secret and register it for masking BEFORE writing
+          # it to the environment, so it is redacted everywhere in the logs
+          # (including the env-group dumps of every later step). Do not echo it.
+          ENV_API_KEY=$(echo "$response" | jq -r '.secret')
+          echo "::add-mask::$ENV_API_KEY"
+          echo "ENV_API_KEY=$ENV_API_KEY" >> "$GITHUB_ENV"
 
       - name: local PDP runnning
         env: