v3 apply manifest logs full buildpack url, even if it has token embedded

This applies to most CAPI versions.

Reproduction Steps

If you use a buildpack via -b on cf push with git url the credentials form the git clone are logged in plain text in the app logs.

cf push test-app -b https://oauth2:TOKEN@git.mycompany.com/repo/test-buildpack.git

The full url will be logged in the app logs accessible via cf logs test-app

The code that logs this is here : https://github.com/cloudfoundry/cloud_controller_ng/blob/440812ed951baf001eff04a6a229136e8573afc1/app/repositories/app_event_repository.rb#L48

Remediation

The CAPI team believes the only way to fix this would be to hide the entire buildpack URL from log output, since using a token in your buildpack URL in the manifest is not a usual use case, we recommend that if you need to use a token in your buildpack URL you follow the below steps.

cf create-buildpack test-buildpack https://oauth2:TOKEN@git.mycompany.com/repo/test-buildpack.git positional-number (such as 1)
cf push test-app -b test-buildpack

Currently the plan is to not fix this issue, if we decide to fix it in the future, we would most likely have to hide the entire buildpack url from the manifest as it would be tricky to programmatically determine if a token is in the URL

cc: @moleske @sweinstein22

Start with app/repositories/app_event_repository.rb at the linked logging code and reproduce the manifest buildpack case with the supplied cf push command. Trace how the buildpack URL reaches app logs and determine an accepted redaction or hiding requirement; done means the token is no longer exposed through cf logs.