redact: make RedactableString non-constructable

[knz]

Suggested/recommended by @tbg:

A trick we use elsewhere is type RedactableString struct { s string } so you cannot hand-make one.

One issue we'd need to address is that there are a few legitimate casts of string to RedactableString in the log package, specifically in the parsing of log entries from disk.

One option is to make the redact package aware of the "vertical ellipsis protocol" and responsible for serialization to/from disk formats, so that there's no remaining cast to/from strings.

Epic: CRDB-6668

Jira issue: CRDB-4159