Add support for UC secrets

[andrewnester]

Changes

Add support for Unity Catalog (UC) secrets as a first-class DAB resource type under the direct deployment engine.

Notes:

• Secret values are never persisted to deployment state — the remote plaintext is not returned by the API and is intentionally omitted from state to avoid leaking secrets
• New validation mutator (ValidateSecretValueIsVariable) that rejects plain-text value fields at bundle validation time — the value must be a variable reference (e.g. ${var.my_secret}) so secrets are never committed to databricks.yml

Fixes #3689

Example

bundle:
  name: my-bundle

variables:
  my_secret_value:
    description: "Secret value passed at deploy time"

resources:
  secrets:
    my_secret:
      catalog_name: main
      schema_name: default
      name: my_api_key
      value: ${var.my_secret_value}
      comment: "API key for external service"

Tests

Acceptance tests covering create/update/delete, update-value, direct-only enforcement, and the plain-text validation error

[github-actions]

Approval status: pending

/acceptance/bundle/ - needs approval

26 files changed
Suggested: @pietern
Also eligible: @janniklasrose, @denik, @shreyas-goenka, @anton-107, @lennartkats-db

/bundle/ - needs approval

21 files changed
Suggested: @pietern
Also eligible: @janniklasrose, @denik, @shreyas-goenka, @anton-107, @lennartkats-db

General files (require maintainer)

6 files changed
Based on git history:

• @pietern -- recent work in libs/testserver/, bundle/direct/dresources/, bundle/internal/validation/generated/

_{Any maintainer (@anton-107, @denik, @pietern, @shreyas-goenka, @simonfaltum, @renaudhartert-db, @janniklasrose) can approve all areas.
See OWNERS for ownership rules.}

[eng-dev-ecosystem-bot]

Integration test report

Commit: 3821f05

Run: 29019194623

	Env	🔄​flaky	💚​RECOVERED	🙈​SKIP	✅​pass	🙈​skip	Time
💚​	aws linux		4	4	230	1081	5:22
💚​	aws windows		4	4	232	1079	7:03
💚​	aws-ucws linux		4	4	314	999	5:52
🔄​	aws-ucws windows	2	4	4	314	997	7:59
💚​	azure linux		4	4	230	1080	4:41
💚​	azure windows		4	4	232	1078	7:12
💚​	azure-ucws linux		4	4	316	996	6:02
💚​	azure-ucws windows		4	4	318	994	7:08
💚​	gcp linux		4	4	229	1082	4:56
💚​	gcp windows		4	4	231	1080	6:47

10 interesting tests: 4 RECOVERED, 4 SKIP, 2 flaky

	Test Name	aws linux	aws windows	aws-ucws linux	aws-ucws windows	azure linux	azure windows	azure-ucws linux	azure-ucws windows	gcp linux	gcp windows
💚​	TestAccept	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R
🙈​	TestAccept/bundle/invariant/no_drift	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/bundle/resources/vector_search_endpoints/drift/recreated_same_name	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/bundle/resources/vector_search_indexes/recreate/embedding_dimension	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/ssh/connection	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🔄​	TestFilerWorkspaceNotebook	✅​p	✅​p	✅​p	🔄​f	✅​p	✅​p	✅​p	✅​p	✅​p	✅​p
🔄​	TestFilerWorkspaceNotebook/sqlNb.sql	✅​p	✅​p	✅​p	🔄​f	✅​p	✅​p	✅​p	✅​p	✅​p	✅​p
💚​	TestFetchRepositoryInfoAPI_FromRepo	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R
💚​	TestFetchRepositoryInfoAPI_FromRepo/root	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R
💚​	TestFetchRepositoryInfoAPI_FromRepo/subdir	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R

Top 10 slowest tests (at least 2 minutes):

duration	env	testname
6:16	aws-ucws windows	TestAccept
6:12	azure windows	TestAccept
5:57	azure-ucws windows	TestAccept
5:57	aws windows	TestAccept
5:56	gcp windows	TestAccept
2:57	gcp linux	TestAccept
2:54	aws linux	TestAccept
2:53	azure linux	TestAccept
2:46	aws-ucws linux	TestAccept
2:45	azure-ucws linux	TestAccept