Keep the new "%P" query conversion out of the service call profiler by unmasking later

Summary:
Ref T13216. Ref T13217. Ref T6960. Although the new "%P" (password/secret) conversion can mask values, we currently convert it too early in the stack, and pass the unmasked query to the service call profiler. This means the unmasked query appears in the service call profiler, etc.

Instead, unmask slightly later in the stack so the call profiler gets the masked string.

Test Plan: See next change.

Reviewers: amckinley

Reviewed By: amckinley

Maniphest Tasks: T13217, T13216, T6960

Differential Revision: https://secure.phabricator.com/D19811