This to avoid printing secrets into logs, as another layer of
security, even though the CI environments are isolated and
short-lived.

The change does the following:

* Default `use_no_log: true`.

* Add `use_no_log` onto more tasks.

* Disable xtrace (`set -x`) on such tasks as another precaution. This
  is done via a new `shell_header_no_xtrace` variable so that the
  behavior is not hardcoded.

If debugging of the relevant tasks is necessary, it can be done by
tweaking these variables for a testproject.

Assisted by: goose+gemini