feat: Secret Manager SanitizingFunction #4122

[kioie]

Description

This PR is a fix for #4122: secrets loaded from GCP Secret Manager were exposed in plain text via /actuator/env when management.endpoint.env.show-values was set to always or when-authorized.

Changes

• Implements SanitizingFunction. When a property's unresolved value (from the PropertySource) contains a ${sm@...} or ${sm://...} reference, the resolved secret is replaced with the unresolved expression so the real secret is never surfaced.
• Added a new @bean to auto-register the sanitizing function, guarded by @ConditionalOnClass(SanitizingFunction.class) so it only activates when spring-boot-actuator is on the classpath
• Added testSanitizingFunctionBeanRegistered to verify the bean is present in the application context.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.