fix: replace literal BrowserStack access key with placeholder in SDK / yml tool output

[SavioBS629]

What this PR does

Stops the BrowserStack SDK setup instructions and browserstack.yml generator from emitting the literal
BROWSERSTACK_ACCESS_KEY into MCP tool output. Output now contains a <your BrowserStack access key>
placeholder; users substitute their key locally.

Why

Same prompt-injection exfil class as PMAA-100's Percy token leak: anything in MCP tool response text can be
recovered from LLM transcripts, shared sessions, or compromised assistant sessions. The access key is
user-supplied (lower severity than the server-fetched Percy token) but the path is identical.

Flagged during PMAA-100 security review as the "Adjacent concern" —
explicitly framed as out-of-scope for PMAA-100 with a recommendation to open a follow-up audit ticket. This
is that follow-up.

Changes

• src/tools/sdk-utils/bstack/commands.ts — getSDKPrefixCommand (and its internal helpers) no longer take
  an accessKey parameter. Output uses a shared ACCESS_KEY_PLACEHOLDER constant.
• src/tools/sdk-utils/bstack/configUtils.ts — generateBrowserStackYMLInstructions emits accessKey: "<your BrowserStack access key>" in the rendered browserstack.yml.
• src/tools/sdk-utils/percy-bstack/handler.ts, src/tools/sdk-utils/bstack/sdkHandler.ts — callers updated
  to drop the now-removed accessKey argument.
• tests/tools/sdk-utils-commands.test.ts — assertions inverted to pin the new contract: the placeholder
  must appear; the access key must not.

Behavioural change

Maven and Node.js setup commands in tool output now contain the placeholder string where the literal key used
to appear. Users substitute their key before running — matches the pattern used for the Percy token
(#288).

Out of scope (worth a separate audit if not already tracked)

Other ${accessKey} interpolation sites that this PR doesn't touch:

• src/tools/sdk-utils/bstack/constants.ts — 6 sites
• src/tools/appautomate-utils/appium-sdk/languages/java.ts — 2 sites
• src/tools/appautomate-utils/appium-sdk/languages/nodejs.ts — 1 site

Verification

• npm run build → lint, format, 171 tests pass, tsc clean.
• getSDKPrefixCommand is not imported anywhere outside src/tools/sdk-utils/bstack/ and
  src/tools/sdk-utils/percy-bstack/ (verified via grep -rn).