Lots of plugins are configurable with the configuration-as-code plugin (see https://github.com/jenkinsci/configuration-as-code-plugin).

It's currently not possible to configure the mask password plugin (Descriptor doesn't expose any setter, so nothing you can configure).