Use custom marshaller to clarify redactions

[evankanderson]

What type of PR is this?

fix: Make redacted fields show as "[redacted]" rather than "W3JlZGFjdGVkXQ=="

What this PR does / why we need it:

I started preparing to report a security issue with Envoy Gateway because I noticed that our logs contained a "privateKey" with a base64-encoded value. Eventually, while trying to get the key to line up with the certificate, I base-64 decoded the contents, and saw that the value was [redacted]. I'm hoping this avoids future users getting freaked out like I did.

As a maybe-beneficial side-effect, it shouldn't be necessary to call Printable() to avoid leaking XDS secret information when marshalling to/from JSON or YAML.

Which issue(s) this PR fixes:

I didn't end up filing a bug yet.

Release Notes: No

[evankanderson]

Note: this incorporates #4505 , as that changed the format of JSONString().

[codecov]

Codecov Report

Attention: Patch coverage is 10.71429% with 25 lines in your changes missing coverage. Please review.

Project coverage is 65.60%. Comparing base (9c9f435) to head (83abc1f).
Report is 76 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/ir/xds.go	10.71%	24 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4506      +/-   ##
==========================================
- Coverage   65.66%   65.60%   -0.07%     
==========================================
  Files         211      211              
  Lines       31689    31691       +2     
==========================================
- Hits        20810    20791      -19     
- Misses       9677     9696      +19     
- Partials     1202     1204       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[evankanderson]

Hold off on reviewing this; it looks like I missed make -k gen-check, which seems to be getting a bunch of double-base-64 encodings from somewhere even when I account for empty-bytes --> nil rather than [redacted].

[evankanderson]

I think I've fixed the errors from make gen-check, though it did add a bit of extra (mostly test) complexity.

[zirain]

LGTM
cc @shawnh2

[arkodg]

sorry for the late reply
LGTM thanks !

[shawnh2]

LGTM