template: disable sandboxed rendering on Windows

[pkazmierczak]

Following #23443, we no longer need to sandbox template rendering on Windows.

Relates to: #20585
Relates to: #20034
Internal ref: https://hashicorp.atlassian.net/browse/NET-9311

This is part of a solution outlined in RFC NMD-195.

[tgross]

I think I understand where you're going with this, but the TaskTemplateManagerConfig we're passing in is still having a ReaderFn and RenderFn set. By having those functions just empty return nil, I think we end up not rendering at all because we never read anything. That should be detected by tests on Windows but doesn't seem to be?

I'd probably leave the TaskTemplateManagerConfig constructor in place for both Windows and default, and have the ReaderFn and RenderFn on Windows just call os.Open/Read and CT's own render function directly.

[pkazmierczak]

but the TaskTemplateManagerConfig we're passing in is still having a ReaderFn and RenderFn set.

yeah these ReaderFn and RenderFn functions are somewhat misleading. They are only ever used when the sandbox is enabled. So since we no longer support sandboxing on Windows, they should return nil, because ct will default them. (this also solves the mystery why the tests passed)

[tgross]

yeah these ReaderFn and RenderFn functions are somewhat misleading. They are only ever used when the sandbox is enabled.

Oh right, what I was missing was that the ReaderFn and RenderFn functions are "factory" functions! (Which is hilarious because I wrote all this junk! 🤦) So they're getting called to return a nil function for that configuration, which CT will accept and replace with its own default internal functions.

LGTM!