feat: column-level Dynamic Data Masking (masked_with / masks)

[Benjamin-Knight]

Applies SQL Server Dynamic Data Masking to columns as part of the materialization, so masks are re-applied on every build and survive a full-refresh rebuild. A principal with SELECT but not UNMASK sees masked values. Base tables only (table / incremental / snapshot); requires SQL Server 2016+. Resolve #572

Config — two surfaces, use either or both

• Column-level masked_with: — a first-class column property in schema YAML:

  columns:
    - name: nhs_number
      masked_with: 'partial(0,"XXXXXXXXXX",0)'

• Model-level masks — a {column: function} dict in {{ config() }}, .yml config:, or a dbt_project.yml directory default. Merges key-wise across those levels (like meta) rather than clobbering:

  {{ config(masks={'surname': "default()", 'nhs_number': 'partial(0,"XXXXXXXXXX",0)'}) }}

Behaviour

• Precedence: column-level masked_with wins over a model-level masks entry; conflicts are warned.
• Opt out: masked_with: null removes an inherited default.
• Idempotent: diffs against sys.masked_columns and emits only changed ADD / MASKED WITH / DROP MASKED DDL.
• Validation: unknown columns are skipped with a warning; unmaskable column types error.
• Indexes: masks are applied before rowstore index creation so masked index-key columns work on fresh builds; adding a new mask to an existing index key on a persisted table errors with the documented workaround.