version 22.8.4.7

How to reproduce:

1. Add section to config.xml
`    <query_masking_rules>
        <rule>
            <name>hide encrypt/decrypt arguments</name>
            <regexp>((?:aes_)?(?:encrypt|decrypt)(?:_mysql)?)\s*\(\s*(?:'(?:\\'|.)+'|.*?)\s*\)</regexp>
            <!-- or more secure, but also more invasive:
                (aes_\w+)\s*\(.*\)
            -->
            <replace>\1(???)</replace>
        </rule>
    </query_masking_rules>
`
2. Run query and get exception
`select decrypt('aes-256-ecb', 'my_text', 'mykey123451234512345123451234512');` 

3. Check query_log
`select exception, query from system.query_log
where exception_code>0
order by event_time desc
limit 1`

Here we have masked query 
`select decrypt(???)`
And not masked exception message
`Code: 454. DB::Exception: Failed to decrypt. OpenSSL error code: 503316603: While processing decrypt('aes-256-ecb', 'my_text', 'mykey123451234512345123451234512'). (OPENSSL_ERROR) (version 22.8.4.7 (official build))`
And for example, i can easily get encrypt key from the exception message
{
    try
    {
        std::rethrow_exception(e);
    }
    catch (const Exception & exception)
    {
        return exception.code();
    }
    catch (const Poco::Exception &)
    {
        return ErrorCodes::POCO_EXCEPTION;
    }
    catch (const std::exception &)
    {
        return ErrorCodes::STD_EXCEPTION;
    }
    catch (...)
    {
        return ErrorCodes::UNKNOWN_EXCEPTION;
    }
}
void rethrowFirstException(const Exceptions & exceptions)