Fix pulumi refresh diffs

[lukehoban]

Refresh diffs should be diffs of outputs not inputs. The code was previously attempting to do this - but was not correct because OpRefresh transmogrifies itself into OpUpdate, OpSame or OpDelete as it is processed, and so those resulting operations (which were what shows the diff) would render their input diff as normal.

Instead, decide whether to render refresh-based output diffs based on whether the action being performed is a pulumi refresh instead of using the Op kind.

Before:

     Type                                   Name                                   Plan       Info
     pulumi:pulumi:Stack                    refresh-test-luke-dev                             
     ├─ aws:s3:Bucket                       b                                                 
     │  ├─ aws:s3:BucketEventSubscription   newObj                                            
     │  │  ├─ aws:iam:Policy                newObj-LambdaFullAccess                           
     │  │  ├─ aws:iam:RolePolicyAttachment  newObj-lambdaFullAccessCopyAttachment             [diff: -__defaults]
 ~   │  │  ├─ aws:iam:Role                  newObj                                 update     [diff: ~assumeRolePolicy]
     │  │  ├─ aws:lambda:Permission         newObj                                            
 ~   │  │  └─ aws:lambda:Function           newObj                                 update     [diff: ~code]
     │  └─ aws:s3:BucketNotification        newObj                                            [diff: -__defaults~lambdaFunctions]
     ├─ aws:ec2:SecurityGroup               web-secgrp                                        [diff: ~ingress]
     └─ aws:ec2:Instance                    web-server-www                                    [diff: ~tags]
 
Resources:
    ~ 2 to update
    9 unchanged

After:

     Type                                   Name                                   Plan       Info
     pulumi:pulumi:Stack                    refresh-test-luke-dev                             
     ├─ aws:s3:Bucket                       b                                                 
     │  ├─ aws:s3:BucketEventSubscription   newObj                                            
     │  │  ├─ aws:iam:Policy                newObj-LambdaFullAccess                           
 ~   │  │  ├─ aws:iam:Role                  newObj                                 update     [diff: ~managedPolicyArns]
     │  │  ├─ aws:iam:RolePolicyAttachment  newObj-lambdaFullAccessCopyAttachment             
     │  │  ├─ aws:lambda:Permission         newObj                                            
 ~   │  │  └─ aws:lambda:Function           newObj                                 update     [diff: ~code,lastModified]
     │  └─ aws:s3:BucketNotification        newObj                                            
     ├─ aws:ec2:SecurityGroup               web-secgrp                                        
     └─ aws:ec2:Instance                    web-server-www                                    
 
Resources:
    ~ 2 to update
    9 unchanged

The after above captures what is actually changed (module the ~code diff, which is due to pulumi/pulumi-aws#3548).

Related to #6243, #5713, #5816 and possibly others.