Fix CredentialProviderToken serialization

[ctubbsii]

• Fix the serialization of CredentialProviderToken, so it serializes the name and credential provider paths, rather than the resolved password from the provider
• Add comments to reserve specific magic numbers/versions for serialization to separate it from PasswordToken's serialization
• Mark internal method as private
• Also fix issue in CreateToken where only the most recent property was being used to initialize a token, instead of all the properties

This fixes #4573

[keith-turner]

Could add a unit test to CredentialProviderTokenTest that ensures the serialized of form CredentialProviderToken does not contain a password.

[gwynlionhart]

Thanks, I gave it a shot through tests and it looks fine. Regarding a test on whether the serialization contains a password, I wrote a small one:

  public void deserializesWithoutPassword() throws Exception {
    CredentialProviderToken token = new CredentialProviderToken("bob.password", keystorePath);
    String serializedTokenString = new String(AuthenticationToken.AuthenticationTokenSerializer.serialize(token));
    assertFalse(serializedTokenString.contains(new String(token.getPassword())));
  }

You'd have to make a jceks file where the password value doesn't contain any string from the JCEKS alias. My test fails for me because the passwords.jceks values all have the word "password" in the alias name with a password "password". But visually inspecting the serialized string and it no longer displays the password.