CFE-3293: Added tracking of secret variables for later redaction

[nickanderson]

EvalContextVariableGet() always returned the plaintext value, so a caller had no
way to ask for a secret-tagged variable to be redacted. This adds a get_secret
parameter, plus EvalContextVariableGetPlaintext() and friends, and moves the 20
existing call sites in core onto the plaintext form.

No behaviour change: every call site asks for plaintext, exactly as before. It is
the groundwork for the CFE-3294 leak fixes, which switch selected sites over.

It also fixes an indexed read of a secret-tagged container (mydata[key]) aborting
in RvalContainerValue(): the declared type was reported while the returned value
was the redacted scalar sentinel. Not reachable until a caller passes
get_secret=false, which the CFE-3294 work does.

Needs paired changes in the enterprise and nova repos, which call these accessors
and will not compile against the new signature — enterprise/libcfserverd/server.c
and four sites in nova/cf-hub/cf-hub.c. All three need to land together:

• https://github.com/cfengine/enterprise/pull/992
• https://github.com/cfengine/nova/pull/2691

[victormlg]

Nice! Some comments:

[victormlg]

Please squash the two commits

I started a build:

[nickanderson]

@cf-bottom jenkins, please

[cf-bottom]

Alright, I triggered a build:

Jenkins: https://ci.cfengine.com/job/pr-pipeline/14558/

Packages: http://buildcache.cfengine.com/packages/testing-pr/jenkins-pr-pipeline-14558/

[nickanderson]

@cf-bottom jenkins, please

[cf-bottom]

Sure, I triggered a build:

Jenkins: https://ci.cfengine.com/job/pr-pipeline/14563/

Packages: http://buildcache.cfengine.com/packages/testing-pr/jenkins-pr-pipeline-14563/