fix(ci): install libguestfs-tools on nested PVE and mask test password

- prepare-test-vm.sh: install libguestfs-tools if not present on the
  fresh nested PVE before running virt-customize
- Mask PVE_PASSWORD in logs via ::add-mask:: to prevent leaking

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/integration-tests.yml

@@ -119,6 +119,9 @@ jobs:
             vm_name: pve-test-pve8
 
     steps:
+      - name: Mask test password
+        run: echo "::add-mask::${PVE_PASSWORD}"
+
       - uses: actions/checkout@v5
 
       - name: Download module artifact