Fix #113: Use getpass for secret prompts in all auto-collectors

[mattiagggg]

Summary

Replace input() with getpass.getpass() for secret prompts (tokens, passwords, app secrets) in all auto-collector setup_config() functions to prevent credentials from being displayed in plaintext on screen during setup.

Changes

• tools/dingtalk_auto_collector.py: Use getpass.getpass() for the access token prompt
• tools/feishu_auto_collector.py: Use getpass.getpass() for app ID and app secret prompts
• tools/slack_auto_collector.py: Use getpass.getpass() for the bot token prompt
• CONTRIBUTING.md: Add security note reminding contributors to use getpass for any secret/credential prompts

Testing

• python -m compileall tools/ — verify no syntax errors across all collector modules
• Run each collector with --setup and confirm secret fields mask input while non-secret fields (e.g., channel names) still echo normally
• python -m unittest discover -s tests — existing tests pass with no regressions

Closes #113