fix: don't reveal nested attributes with sensitive schema

[brandonc]

Description

Fixes several bugs in the plan diff rendering of nested attributes

• When a schema attribute is sensitive, but also contains nested attributes, terraform reveals the nested attributes. The renderer checks for sensitive values at this nesting level, but ignores sensitive schema.
• There is a mixture of "(sensitive)" and "(sensitive value)" output in the plan diff and I changed them all to "(sensitive value)"
• Certain nested attribute modes don't output consistent new values for delete plans or unknown values

I also added a lot more test coverage for single nested attribute mode and sensitive schema nested attributes

Sample Config

terraform {
  required_providers {
    nested = {
      source = "alisdair/nested"
    }
  }
}

resource "nested_single" "example" {
  name = "my_nested_single"

  sensitive_value = {
    string = "secret"
  }
}

resource "nested_list" "example" {
  name = "my_nested_list"

  sensitive_values = [{
    string = "secret"
  }]
}

resource "nested_blocks" "example" {
  name = "my_nested_list"

  list {
    sensitive_value = {
      string = "secret"
    }
  }
}

Before:

After:

Target Release

1.4.0, 1.3.5

Draft CHANGELOG entry

BUG FIXES

When rendering a diff of nested attributes, Terraform now hides the entire nested object if it is marked sensitive by the provider schema

[Uk1288]

🎉 good work! I was able to smoke test this with deep nested resources as well.

[brandonc]

@jbardin Hey, James, I revisited this change and fixed several inconsistencies with nested attributes, as well as standardized the (sensitive value) output in the plan diff. I also modified the PR description accordingly.

I can't see what's going on with the vercel deployment, but there were some minor documentation changes to reflect the (sensitive value) output.

[github-actions]

Reminder for the merging maintainer: if this is a user-visible change, please update the changelog on the appropriate release branch.

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.