feat(aws-msk-apache-kafka-cluster-master): extra SCRAM secret ARNs and sensitive password output

[ariqf79]

Summary

Two changes to aws-msk-apache-kafka-cluster-master, one commit each.

1. feat: extra SCRAM secret ARNs in the cluster association

aws_msk_scram_secret_association.default only listed the module's own secret. If a SCRAM secret was associated with the cluster outside Terraform, the next apply disassociated it, because the resource manages the whole list.

This adds an optional extra_scram_secret_arns input. Its ARNs are added to the association after the module-managed secret, and compact() removes empty entries.

• variables.tf: new extra_scram_secret_arns (list(string), default [])
• main.tf: secret_arn_list = compact(concat([aws_secretsmanager_secret.sm[0].arn], var.extra_scram_secret_arns)); count is unchanged
• README.md: input documented

2. fix: mark the password output sensitive

The password output (added in 0.2.0) was not marked sensitive. Any plan or apply that shows outputs, including CI logs, uploaded plan files and plan text posted to PR comments, printed the module-managed SCRAM user's password in plain text.

• outputs.tf: sensitive = true and a description. The value expression is unchanged.
• README.md: password added to the Outputs table

Notes for callers

• Re-exported password: a root module that re-exports password must mark its own output sensitive = true. Otherwise terraform plan fails with "Output refers to sensitive values".
• Out-of-band secrets: pass ARNs only. Create the secrets and their values outside Terraform so passwords stay out of state.
• KMS key: MSK rejects secrets encrypted with the Secrets Manager default key. Each secret must use the cluster's KMS key (encryption_at_rest_kms_key_arn).
• No resource changes: with extra_scram_secret_arns at its default [], the association is the same single ARN as before. The only plan change is the password output becoming (sensitive value).
• Earlier plans: this doesn't redact plans already printed by callers on 0.2.x. If those plans went anywhere shared, consider rotating the module-managed password.

Validation

Run from modules/aws-msk-apache-kafka-cluster-master:

• terraform init -backend=false: OK
• terraform validate: Success
• terraform fmt -check main.tf variables.tf: OK
• terraform fmt -check outputs.tf: flags one line, the double space in value = var.client_sasl_scram_enabled ? … in the password output. That line is unchanged from main, and this PR leaves it as is to keep the diff minimal.

Not run: terraform plan, which needs real inputs and AWS credentials.

Release

Squash-merge takes the PR title as the release-please entry, so the fix above ships in the same minor release without its own changelog line unless the squash body lists it.

BEGIN_COMMIT_OVERRIDE
feat(aws-msk-apache-kafka-cluster-master): allow extra SCRAM secret ARNs in the cluster association
fix(aws-msk-apache-kafka-cluster-master): mark the password output sensitive
END_COMMIT_OVERRIDE