Mask a card number for display, keeping the first six and last four digits (the PCI-permitted maximum) and replacing the rest with a mask character (default `*`).