The string '< Hidden >' was agreed on as a good default, so we will use the hidden_field key.
I also moved the definition in en.yml up to the more general area at the start of admin.reports section (before it was hidden between report-specific keys.
when permitted.
The MaskDataService is used by the report framework, so this should affect all reports. It would be nice to test all reports, but I figured it wasn't worth it (already we only test one report for masking names).
