Preserve filled state for redacted password inputs in DOM snapshots

Problem

Browser Use now correctly avoids sending password values to the LLM, but the redaction path also removes the only observable indication that a password input is non-empty. A password field with a value and an empty password field are serialized identically. In form flows where the agent refreshes the DOM or verifies progress, the model can interpret an already-filled password as empty and type it repeatedly.

This is a follow-up to #5647/#5650: live values are now captured from DOMSnapshot.captureSnapshot, while sensitive values are intentionally excluded. The sensitive path needs to preserve field state without exposing the value.

Reproduction

1. Navigate to a page containing two visible input[type=password] controls.
2. Set one control's live .value to a non-empty string and leave the other empty.
3. Capture the browser state and inspect the serialized DOM.

Both controls currently omit the live value and provide no state marker, so the LLM cannot distinguish them.

Expected behavior

Keep the password, file, hidden, payment, and one-time-code values redacted, but expose a non-sensitive state marker such as value-state=filled, value-state=empty, or value-state=unknown.

The marker should be derived from the live snapshot value and must never include the value itself or its contents.

Proposed fix

Store a boolean presence bit separately from the redacted value in EnhancedSnapshotNode, then emit the three-state marker only for password fields in the LLM-facing serializer. Add a regression test covering filled, empty, and cleared password inputs and asserting that the secret never appears in the serialized state.