perf: Use HashSet for O(1) secret masking lookups (#1723)

Fixes #1539

Changed BuildSystemSecretMasker from List<string> to HashSet<string> for
tracking already-masked secrets. This provides O(1) lookup instead of O(n),
improving performance when many secrets need to be masked.

Before: O(n*m) where n=existing secrets, m=new secrets
After: O(m) - each new secret is O(1) lookup

HashSet.Add() returns false if the item already exists, eliminating the
need for a separate Contains() check.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Author: thomhurst

src/ModularPipelines/Engine/BuildSystemSecretMasker.cs

@@ -28,7 +28,7 @@ internal class BuildSystemSecretMasker : IBuildSystemSecretMasker
     private readonly IBuildSystemFormatterProvider _formatterProvider;
     private readonly IConsoleWriter _consoleWriter;
 
-    private readonly List<string> _alreadyMaskedSecrets = new();
+    private readonly HashSet<string> _alreadyMaskedSecrets = new();
     private readonly object _lock = new();
 
     public BuildSystemSecretMasker(IBuildSystemFormatterProvider formatterProvider,
@@ -44,9 +44,13 @@ public void MaskSecrets(IEnumerable<string> secrets)
         {
             var formatter = _formatterProvider.GetFormatter();
 
-            foreach (var secret in secrets.Where(s => !_alreadyMaskedSecrets.Contains(s)))
+            foreach (var secret in secrets)
             {
-                _alreadyMaskedSecrets.Add(secret);
+                // HashSet.Add returns false if already exists, providing O(1) lookup
+                if (!_alreadyMaskedSecrets.Add(secret))
+                {
+                    continue;
+                }
 
                 var maskCommand = formatter.GetMaskSecretCommand(secret);
                 if (maskCommand != null)