editproj.cgi: implement protected edit fields

editproj.cgi: implement protected edit fields

Some fields on the editproj page may contain sensitive information.

Up until now, all project fields have always been displayed when
the edit project link is selected -- even those fields that are not
otherwise visible anywhere else.

The notification email addresses and JSON POST urls may be considered
sensitive information that should not just be blindly available to
anyone who clicks the "edit" link on a project page.

Solve this problem by making fields that contain sensitive information,
specifically the ones in the $Girocco::Config::protect_fields hash,
not visible or editable until the project's admin password has been
entered.

At the same time, enforce an editing time limit, specifically the
$Girocco::Config::project_edit_timeout value, when editing so that
very stale pages cannot just be submitted even if they contain the
correct password.

Currently the list of users allowed to push is *NOT* considered a
sensitive field.  That may need to be revisited at some point.

Signed-off-by: Kyle J. McKay <mackyle@gmail.com>