Change reading passphrase from stdin to be explicit

[same-id]

Require users to pass --stdin to:

pulumi stack change-secrets-provider passphrase

Allow passing passphrase through stdin non-interactively also when existing passphrase is not being rotated.

Description

Fixes # (issue)

Checklist

• I have run make tidy to update any new dependencies
• I have run make lint to verify my code passes the lint check
  • I have formatted my code using gofumpt

• I have added tests that prove my fix is effective or that my feature works

• I have run make changelog and committed the changelog/pending/<file> documenting my change

• Yes, there are changes in this PR that warrants bumping the Pulumi Cloud API version

[github-actions]

PR is now waiting for a maintainer to take action.

Note for the maintainer: Commands available:

• /run-acceptance-tests - used to test run the acceptance tests for the project
• /run-codegen - used to test the Pull Request against downstream codegen
• /run-docs-gen - used to test the Pull Request against documentation generation

[pulumi-bot]

Changelog

[uncommitted] (2023-11-29)

Features

• [cli/config] Change reading passphrase from stdin to be explicit

[same-id]

I can also block empty passwords through -stdin in this same PR.

Already now you can not set an empty password using environment variables.
So no reason we will keep supporting password rotation to an empty password.

However -stdin still has to be explicit because right now pulumi's behavior is not consistent.

For example, look at the following code:

pulumi stack init stax --secrets-provider gcpkms://...

export PULUMI_CONFIG_PASSPHRASE=foo

echo bar | pulumi stack change-secrets-provider passphrase

What will be the passphrase? foo or bar?
Depends on whether pulumi decides rotate is false or true respectively.

However in:

pulumi stack init stax --secrets-provider gcpkms://...

export PULUMI_CONFIG_PASSPHRASE=foo

echo bar | pulumi stack change-secrets-provider passphrase --stdin

It has to be bar or failure.