[connector builder design] Protect against connector developer accidentally leaking their secrets

[girarda]

How can we prevent developers from saving their real production secrets as part of the connector configuration? E.g: how can we prevent someone from saving their API key as part of the connector configuration

[lmossman]

I believe @flash1293 is solving this by hardcoding secret fields to always come from user inputs, as he describes in this PR: #20645

[flash1293]

Exactly, we lose a tiny bit of functionality (the ability to have an interpolated string for the authentication secrets), but IMHO this trade-off is worth it for the UI to make it much harder to accidentally encode secrets where they don't belong