Improve handling of secrets in porter bundles

[JC-wk]

Describe the bug

Sensitive credentials are not consistently redacted from Terraform deployment logs when a deployment fails.

Some occurrences of the Terraform command are masked, while others expose values passed as command-line arguments, for example:

-var auth_client_secret=<value>
-var client_secret=<value>

Expected behavior

Sensitive values should be redacted consistently in Porter, Terraform, shell, and pipeline logs.

This requires assigning sensitive: true in the porter.yaml of each template for the azure credentials to prevent leakage in to logs.

Or ideally handling secrets differently (Out of scope of this issue). Will log a separate issue to investigate whether secrets can avoid command-line arguments entirely in future, for example by using:

• Azure Key Vault references
• Protected environment variables such as TF_VAR_*
• A protected temporary variables file
• Managed identity or OIDC authentication instead of client secrets

Steps to reproduce

1. Configure a deployment with sensitive credentials.
2. Start a Terraform deployment.
3. Cause Terraform to fail.
4. Review all generated deployment and pipeline logs.
5. Compare repeated Terraform command/error entries.

Azure TRE release version (e.g. v0.14.0 or main):
main
Deployed Azure TRE components - click the (i) in the UI:
latest

Related issues

#2247