(PUP-12050) Check for nested Sensitive arguments

[joshcooper]

Previously, a manifest containing nested Deferred values did not mark the corresponding parameter as sensitive, resulting in the following:

$ cat manifest.pp
$vars = {'token' => Deferred('new', [Sensitive, "password"])}
file { '/tmp/a.sh':
  ensure  => file,
  content => Deferred('inline_epp', ['<%= $token %>', $vars])
}
$ truncate --size 0 /tmp/a.sh
$ puppet apply --show_diff manifest.pp
Notice: Compiled catalog for localhost in environment production in 0.01 seconds
Notice: /Stage[main]/Main/File[/tmp/a.sh]/content:
--- /tmp/a.sh	2024-07-03 17:30:37.024543314 -0700
+++ /tmp/puppet-file20240703-1784698-2cu5s9	2024-07-03 17:30:41.880572413 -0700
@@ -0,0 +1 @@
+password
\ No newline at end of file

The issue occurred because we were only checking if the outermost DeferredValue contained any Sensitive arguments, in this case the arguments passed to inline_epp function, but not the password passed to the new function.

This is not an issue when deferred values are preprocessed, because Deferred values are completely resolved and we can check if resolved value is Sensitive.

The problem was introduced in b92e4d3 which added the ability to lazily call a deferred function when its respective resource is evaluated. It should be backported to 7.x

With this change we get:

$ puppet apply --show_diff manifest.pp
Notice: Compiled catalog for localhost in environment production in 0.01 seconds
Notice: /Stage[main]/Main/File[/tmp/a.sh]/content: [diff redacted]
Notice: /Stage[main]/Main/File[/tmp/a.sh]/content: changed [redacted] to [redacted]
Notice: Applied catalog in 0.04 seconds

Fixes #9384

[joshcooper]

Rubocop failures should be fixed in #9413