Filter out "secret" parameters requested by the manifest

[agrare]

In case a malicious user is able to post a crafted manifest to request e.g. usernames and passwords we should filter out any parameters that are deemed "secret" e.g. ones which are filtered out by the logger or the API already.

[miq-bot]

This issue has been automatically marked as stale because it has not been updated for at least 6 months.

If you can still reproduce this issue on the current release or on master, please reply with all of the information you have about it in order to keep the issue open.

Thank you for all your contributions!