Redact credentials in provider debug output (CWE-532/CWE-732)

[chkp-alias]

The optional debug facility (debug=true / TF_CP_DEBUG) writes API request/response payloads to terraform-gw-requests.jsonl, and every gaia resource additionally logs its raw payload through log.Println. Both paths recorded plaintext credentials:

1. safeCopyMap() copied payloads verbatim, so system passwords (GRUB, expert, OS user, login, PPPoE), SNMP community strings, session IDs, private keys and RADIUS/TACACS/BGP secrets were written out (CWE-532). Nested payloads leaked at any depth.
2. The log file was world-readable (0644) inside a world-traversable directory (0755), so any local user could read what an operator left behind (CWE-732). MkdirAll/OpenFile apply their mode only when creating the path, so tightening the constants alone leaves an existing debug directory from an earlier version untouched.

Fix:

• isSensitiveKey(): explicit list (token, header-bearer-token, community strings, sid, session-id, activation-key, verification-code, private-key) plus substring match on password/secret/passphrase/psk, with _ and - normalised. Values that cannot carry a credential (numbers, booleans) stay readable, so knobs such as password-expiration-days remain useful.
• redactMap()/redactValue(): recursive redaction through maps, slices and typed containers such as expandList's []map[string]interface{}, bounded at depth 32 so a malformed or self-referential payload cannot panic Terraform. A symlinked debug directory or log file is refused.
• Directory 0755 -> 0700 and file 0644 -> 0600, plus an explicit Chmod on both so a path created by a pre-fix version is re-tightened.
• Wrapped the 385 raw payload/response log.Println sites across the 277 gaia resource and data-source files in safeCopyMap.

Redaction affects only the logged copy, never the payload sent to the API.

Added debug_ops_test.go covering nested and typed-container redaction, underscore key spellings, numeric passthrough, self-referential payloads, and re-tightening of a pre-existing 0755/0644 debug path. The tests fail against the unfixed code and pass with the fix.