[SLES-16.0] Do not log the URL password in the "inst.install_url" boot parameter (bsc#1258701)

[lslezak]

Problem

• The password in the URL passed in the inst.install_url boot parameter was logged into the journal and y2log.
• https://bugzilla.suse.com/show_bug.cgi?id=1258701

Solution

• Use the Yast::URL.HidePassword to replace the password with the PASSWORD placeholder.

Testing

• Added a new unit test
• Tested manually, the password is not logged anymore

Notes

• I had to fix the CI, we still use the TW based image which was upgraded to Ruby 4.0. In the SLE-16 branch we should use some 16.0 based image with Ruby 3.4...
• Unfortunately two storage tests still fail. Anyway I did not touch the storage part at all so hopefully that is just a false positive because of Ruby 4.0 or some other change elsewhere (a change in libstorage-ng?).

[dgdavid]

NP: I wonder why not call this directly without the include optimization that it is already done by Yast::URL.HidePassword. I guess to avoid the RegExp execution, but I'm not sure if it worth.

Also, checking the Yast::URL.HidePassword I have realize that now we have "FILTERED" in some places and "PASSWORD" in others. Would be nice to been able to pass the desired mask to Yast::URL.HidePassword as well.

[lslezak]

Yes, I noticed that different replacement. But as this code is for 16.0 only and not used in the future (for 16.1 it was rewritten to Rust) I'd not waste much time here. Just fix the problem in an easy way and be done with that.

[dgdavid]

Thanks for the info, much appreciated.. I didn't know these details and I didn't pay attention that was a PR against 16.0.

[dgdavid]

Just curious to know how we know that it is always #...0x

[lslezak]

The 0x prefix means that the number is in hexadecimal format. To distinguish between 10 decimal and 10 hexa which in decimal is 16. With 0x10 it is clear what does it mean.