[DSIP-105][Feature][Worker] Mask sensitive parameter values in task logs

Search before asking

• I had searched in the issues and found no similar feature requirement.

Description

Subtask of #17937 (DSIP-105). Depends on #18586 (Property.sensitive available on runtime params). Does not require the encryption subtask.

Dynamically redact this task’s sensitive parameter plaintext values from task stdout / agreed task log paths.

In scope

• Input: this task’s prepareParamsMap (or equivalent context) values where sensitive=true
• Behavior: if those values appear in the task log, replace with ****** (extend existing SensitiveDataConverter or equivalent with per-task dynamic patterns)
• Lifecycle: register at task start; must clear on task end (success / failure / kill)
• Must not leak static/global mask state into later unrelated tasks
• Coverage: Physical task execution stdout / task logs; unit tests + log assertions

Out of scope

• Project parameters
• Replacing definition-time encryption
• Claiming coverage of every plugin custom log file
• API/UI masking (already #18586)

Acceptance

• Sensitive param values printed by a script do not appear in the task log (shown as ******)
• After the task ends (including failure / kill), mask patterns are cleaned up
• Two tasks in sequence or in parallel do not pollute each other’s logs
• Unit tests for register / cleanup; concurrent or sequential non-interference

Use case

After API/UI masking, the remaining common leak is task logs (echo ${password}). Operators viewing task logs must not see those secrets.

Related issues

• Parent DSIP: #17937
• Depends on: #18586

Are you willing to submit a PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct