Update local.conf

In etc/rear/local.conf added an explanation how to set a secret value

etc/rear/local.conf

@@ -16,3 +16,11 @@
 # CONDITION_COMMAND && VARIABLE="special_value" || VARIABLE="usual_value"
 # but that means CONDITION_COMMAND gets always executed when 'rear' is run
 # so ensure nothing can go wrong if you run commands in configuration files.
+# Some variables are for secret values (like passwords or encryption keys)
+# which must be set to a secret value in a confidential way via
+#   { VARIABLE='secret_value' ; } 2>/dev/null
+# The STDERR output must be discarded via a compound group command
+#   { confidential_command ; } 2>/dev/null
+# even for a single command to discard STDERR also for 'set -x'.
+# Otherwise the confidential command and its arguments would be shown
+# in the ReaR log file when 'rear' is run in debugscript mode.