Populate DebugBundleUploadURL with a token-bearing value and assert the
rendered bundle contains neither the field name nor the token, in both
anonymize modes. The excluded-map entry only skips the missing-field
check; this guards against the value being serialized by a future change.