Fix/avoid leak secrects in debug log of ifs

[andsel]

Release notes

Fix the leak of secret store secrets when if statements are printed when started with debug log.

What does this PR do?

Updates the ConfigVariableExpander.expand to selectively create SecretVariable instances for SecretStore resolved environment variables.
SecretVariable instances in if statements are decrypted during eq EventCondition compilation; bringing the secret value and using in the comparator.

Why is it important/What is the impact to the user?

Permit the user to avoid leakage into debug log of secret stores's variables, when used in if conditions.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• [ ] I have made corresponding changes to the documentation
• [ ] I have made corresponding change to the default configuration files (and/or docker env variables)
• I have added tests that prove my fix is effective or that my feature works

Author's Checklist

• test with a pipeline and debug log enabled. No leak but the condition should work as expected

How to test this PR locally

• create a local secret store

bin/logstash-keystore create and save into a variable named `SECRET`
bin/logstash-keystore add SECRET

• run Logstash in debug with a pipeline that uses the secret variable

input { http { } }

filter {
  if [@metadata][input][http][request][headers][auth] != "${SECRET}" {
    mutate {
      add_field => { "a_secre_field" => "${SECRET}" }
      add_tag => "${SECRET}"
    }
    drop {}
  } 
}


output {
  stdout {codec => rubydebug {metadata => true}}
}

• verify your secret isn't leak into the logs (run bin/logstash -f <pipeline.conf> --debug)
• verify the pipeline works as expected

curl -v  --header "auth: s3cr3t" "localhost:8080"

an event should be logged to the console.

Related issues

• Fixes secret value show in debug log #13685

Use cases

A user would like to use secret store's resolved variables and avoid to leak in logs/console when Logstash is run with debug or trace levels.

Logs

Example of secret disclosure launching bin/logstash --debug:

[2022-04-14T15:40:21,845][INFO ][logstash.javapipeline    ][main] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>12, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>1500, "pipeline.sources"=>["/home/andrea/workspace/logstash_andsel/leak_secret_in_debug_pipeline.conf"], :thread=>"#<Thread:0xab4113a run>"}
[2022-04-14T15:40:22,249][DEBUG][org.logstash.config.ir.CompiledPipeline][main] Compiled conditional
 [if (event.getField('[@metadata][input][http][request][headers][auth]')!='s3cr3t')] 
 into 
 org.logstash.config.ir.compiler.ComputeStepSyntaxElement@9fb449bc

[jsvd]

much cleaner <3

[jsvd]

LGTM