Fix misleading error message and redact credential URLs from App/PackageRepository status

[nikhilsagotiya]

What this PR does / why we need it:

Two independent, related fixes found while auditing user-facing error/status text in kapp-controller:

1. Error message clarity (cli/pkg/kctrl/cmd/package/available/values_schema.go, config/values-schema.yml):

   • The values-schema.yml caCerts description had a grammar error ("trusted ca's" instead of "trusted CAs"), surfaced to users via kubectl explain and the Package/PackageInstall value schema.
   • The "unsupported type" error raised while parsing a valuesSchema properties field leaked raw Go type syntax (map[string]interface{}, json.RawMessage) at a package author working in YAML/OpenAPI, not Go. Reworded to describe the expected shape in plain terms.

2. Redact credential-bearing URLs from .status (pkg/exec/cmd_run_result.go, pkg/app/app_reconcile.go, pkg/pkgrepository/app_reconcile.go):

   • App and PackageRepository reconciliation copies subprocess (vendir/ytt/kbld/kapp) stdout, stderr, and error text verbatim into .status fields (Fetch, Template, Deploy, Inspect, Conditions[].Message, FriendlyDescription, UsefulErrorMessage).
   • If any of those tools ever emit a credential embedded in a URL (for example a GOPROXY, git, or registry URL of the form https://user:token@host), it lands verbatim in a Kubernetes resource's status — visible via kubectl get app -o yaml and any tooling/logging that reads it.
   • Added exec.RedactSecrets, which masks the userinfo component of a URL (scheme://user:pass@host → scheme://[REDACTED]@host), and applied it at every point subprocess-derived text is written into App/PackageRepository status. The regex is greedy up to the last @ before the host so a userinfo containing a literal @ (e.g. in a password) is fully masked rather than partially.
   • No control flow, exit codes, or non-text status fields changed.

Both are pure message-text/output-sanitization changes; no behavior, API, or control-flow changes.

Which issue(s) this PR fixes:

Fixes #

Does this PR introduce a user-facing change?

Fixed a grammar error in the `caCerts` values-schema description, clarified the error message raised when a package's `valuesSchema.properties` field has an unsupported type, and ensured credential-bearing URLs (e.g. embedded in a GOPROXY/git/registry URL) in subprocess output are redacted before being written to `App`/`PackageRepository` `.status` fields.

Additional Notes for your reviewer:

• Verified locally: go build ./..., go vet ./..., and golangci-lint run (pinned v2.12.2, matching .github/workflows/golangci-lint.yml) are clean on all touched packages (0 issues).
• go test ./pkg/app/... ./pkg/pkgrepository/... ./pkg/exec/... was run locally; two pre-existing failures in pkg/app/pkg/pkgrepository reproduce identically on unmodified develop in this sandbox (missing vendir/kbld binaries in $PATH) and are unrelated to this change — confirmed by stashing the diff and re-running.
• No existing test asserts the exact old message text that changed here, so no test updates were needed.
• The RedactSecrets masking pattern (URL userinfo) covers the credential-leak shape most relevant to this codebase (GOPROXY/git/registry URLs); it does not attempt to redact arbitrary secret shapes (API keys, tokens outside a URL) since none of the current subprocess integrations are known to emit those into status text.

Review Checklist:

• Follows the developer guidelines
• Relevant tests are added or updated
• Relevant docs in this repo added or updated
• Relevant carvel.dev docs added or updated in a separate PR and there's a link to that PR
• Code is at least as readable and maintainable as it was before this change

Additional documentation e.g., Proposal, usage docs, etc.:

[aroradaman]

Changes look good. Just wondering why this doesn't require a unit/integration test change.

[sameerforge]

Changes look good. Just wondering why this doesn't require a unit/integration test change.

Added 16 unit tests for RedactSecrets covering all URL patterns and edge cases; the other changes are text-only.

[joaopapereira]

The PR adds RedactSecrets to sanitize credential-bearing URLs from App/PackageRepository status fields (Fetch, Template, Deploy, Inspect, Conditions.Message, FriendlyDescription, UsefulErrorMessage). The redaction covers the primary credential leak vector (URL userinfo in GOPROXY/git/registry URLs) but does not attempt to redact arbitrary secret shapes (API keys, bare tokens). The satoken logging change also avoids logging full token request objects. These are security-sensitive paths where credential leakage could occur.

Issues

Minor (nice to have)

1. Regex does not cover ssh:// scheme — pkg/exec/cmd_run_result.go:17 pattern ([a-zA-Z][a-zA-Z0-9+.-]*://) allows ssh but the test suite lacks an ssh://user@host case. Git over SSH URLs (ssh://git@github.com/...) are common; adding a test would confirm coverage.
2. No test for RedactSecrets idempotence — calling it twice on already-redacted output should be a no-op; not asserted.
3. Documentation gap — config/values-schema.yml and CLI error message changes are user-visible but no docs/README update noted in checklist (items unchecked). Not blocking.

[sameerforge]

The PR adds RedactSecrets to sanitize credential-bearing URLs from App/PackageRepository status fields (Fetch, Template, Deploy, Inspect, Conditions.Message, FriendlyDescription, UsefulErrorMessage). The redaction covers the primary credential leak vector (URL userinfo in GOPROXY/git/registry URLs) but does not attempt to redact arbitrary secret shapes (API keys, bare tokens). The satoken logging change also avoids logging full token request objects. These are security-sensitive paths where credential leakage could occur.

Issues

Minor (nice to have)

1. Regex does not cover ssh:// scheme — pkg/exec/cmd_run_result.go:17 pattern ([a-zA-Z][a-zA-Z0-9+.-]*://) allows ssh but the test suite lacks an ssh://user@host case. Git over SSH URLs (ssh://git@github.com/...) are common; adding a test would confirm coverage.
2. No test for RedactSecrets idempotence — calling it twice on already-redacted output should be a no-op; not asserted.
3. Documentation gap — config/values-schema.yml and CLI error message changes are user-visible but no docs/README update noted in checklist (items unchecked). Not blocking.

@joaopapereira Thanks for the review. All three points are addressed in 4905303:

1. ssh:// coverage: added Test_RedactSecrets cases for ssh://user@host, ssh://git@github.com/..., and ssh://user:token@host:port. The existing regex already handled these, so no code change was needed.
2. Idempotence: added Test_RedactSecrets_Idempotence, which asserts that RedactSecrets(RedactSecrets(x)) == RedactSecrets(x) across the URL shapes above, plus no-credential and empty inputs.
3. Docs: added docs/credential-redaction.md covering what is redacted, supported schemes, edge cases and limits, and linked it from README.md and docs/README.md.
   Tests in pkg/exec pass.