sandboxes: include dev credentials in yaml

I'm pretty sure that in project.yaml files, and state files downloaded from the provisioner, we want to:

• For credentials marked as private, only include the credential UUID and no other details
• For credentials marked as public, include the full JSON

This means that when I download a production project, I can't run it locally because I don't have any credential data. I need to pass the credential as JSON when I run the workflow from the CLI (note that we might need a little test that this works OK, because of how configuration objects are assembled) (also from the CLI I can only pass state to the first job, I have no means of feeding a credential through to other steps)

But when I download a sandbox with dev credentials, everything is setup and will run right out of the box. Which is probably what you want.

These rules need to be clearly disclosed to users through the appropriate UIs

Trace project.yaml and downloaded state handling in the provisioner, then inspect the CLI path that assembles configuration objects. Verify that private credentials expose only their UUIDs, public credentials include full JSON, and sandbox downloads run with development credentials; identify the appropriate UIs for disclosing these rules.