fix(redactors): move redactor storage from ConfigMaps to Secrets

[xavpaice]

What this PR does / why we need it:

Moves all redactor storage from Kubernetes ConfigMaps to Secrets. The default clusterResources collector includes all ConfigMap data in support bundles in clear text, so redactor definitions that contain literal values (e.g., value-based redactors) were leaking sensitive data into support bundles. Storing redactors in Secrets removes them from that clear-text collection path and protects them with Kubernetes RBAC.

Specifically:

• Bumps github.com/replicatedhq/troubleshoot to v0.133.0, which adds secret/... redactor URI support.
• Moves the kotsadm-redact backend store from a ConfigMap to a Secret.
• Moves the rendered redactor specs (kotsadm-redact-spec, kotsadm-<slug>-redact-spec, kotsadm-redact-default-spec) from ConfigMaps to Secrets.
• Adds startup migrations to migrate the kotsadm-redact backend and delete legacy rendered redactor ConfigMaps.

Which issue(s) this PR fixes:

Fixes https://app.shortcut.com/replicated/story/139291/security-move-redactor-specs-from-configmaps-to-secrets

Does this PR require a test?

Existing tests were updated and new tests were added in:

• pkg/redact/redact_test.go
• pkg/redact/default_test.go
• pkg/supportbundle/migrate_test.go

Does this PR require a release note?

New features:

NONE

Bug fixes:

Fixed a security issue where redactor specs and the `kotsadm-redact` backend ConfigMap were stored as ConfigMaps, causing literal redactor values to be collected in support bundles in clear text. Redactor storage has been moved to Kubernetes Secrets.

Improvements:

NONE

Does this PR require documentation?

NONE

[greptile-apps]

_{Reviews (1): Last reviewed commit: "fix(redactors): move rendered redactor s..." | Re-trigger Greptile}

[greptile-apps]

_{Reviews (2): Last reviewed commit: "fix(redactors): move kotsadm-redact back..." | Re-trigger Greptile}

[xavpaice]

Before:

➜  kots git:(sc-139291-move-redactor-specs-to-secrets) ✗ k get configmap
NAME                                      DATA   AGE
kotsadm-application-metadata              1      46h
kotsadm-id                                1      46h
kotsadm-mattermost-moccasin-redact-spec   1      46h
kotsadm-redact                            0      46h
kotsadm-redact-default-spec               1      46h
kotsadm-redact-spec                       1      46h
kube-root-ca.crt                          1      6d23h
➜  kots git:(sc-139291-move-redactor-specs-to-secrets) ✗ k get secret   
NAME                                                         TYPE                DATA   AGE
kotsadm-mattermost-moccasin-supportbundle                    Opaque              1      46h
kotsadm-mattermost-moccasin-supportbundle-cluster-specific   Opaque              1      45h
kotsadm-mattermost-moccasin-supportbundle-default            Opaque              1      45h
kotsadm-mattermost-moccasin-supportbundle-vendor             Opaque              1      45h
kotsadm-minio                                                Opaque              2      46h
kotsadm-rqlite                                               Opaque              3      46h
kotsadm-sessions                                             Opaque              0      46h
kotsadm-tls                                                  kubernetes.io/tls   3      46h
test-redactor                                                Opaque              1      43h

After:

➜  kots git:(sc-139291-move-redactor-specs-to-secrets) ✗ k get secret   
NAME                                                         TYPE                DATA   AGE
kotsadm-mattermost-moccasin-supportbundle                    Opaque              1      46h
kotsadm-mattermost-moccasin-supportbundle-cluster-specific   Opaque              1      45h
kotsadm-mattermost-moccasin-supportbundle-default            Opaque              1      45h
kotsadm-mattermost-moccasin-supportbundle-vendor             Opaque              1      45h
kotsadm-minio                                                Opaque              2      46h
kotsadm-redact                                               Opaque              0      45s
kotsadm-rqlite                                               Opaque              3      46h
kotsadm-sessions                                             Opaque              0      46h
kotsadm-tls                                                  kubernetes.io/tls   3      46h
test-redactor                                                Opaque              1      43h
➜  kots git:(sc-139291-move-redactor-specs-to-secrets) ✗ k get configmap
NAME                           DATA   AGE
kotsadm-application-metadata   1      46h
kotsadm-id                     1      46h
kube-root-ca.crt               1      6d23h

[xavpaice]

making this draft - not worth the risk, folks shouldn't be putting sensitive info in a redactor anyway

[greptile-apps]

_{Reviews (3): Last reviewed commit: "fix(redactors): move kotsadm-redact back..." | Re-trigger Greptile}