mark plaintext credential fields as sensitive across resources

[naruto-lgtm]

Repro: terraform plan on any of the touched resources with a literal secret, for example google_identity_platform_oauth_idp_config with client_secret = "..."; the plan prints the literal, and so do terraform show and any CI log that captures the run.
Cause: these fields carry plaintext credentials (passwords, OAuth client secrets, a Salesforce security token, bearer and JWT tokens, a PKCS12 passphrase, an encrypted private key) but the schema never marks them sensitive; the sibling Datastream profiles already flag their password, so the Salesforce profile was simply missed, and the remaining fields have the same shape.
Fix: sensitive: true on each field in the product YAML and Sensitive: true on the three handwritten schemas; with the patched provider the same plan renders (sensitive value) for every one of them, and apply and state behavior are unchanged.

Release Note Template for Downstream PRs (will be copied)

datastream: marked `salesforce_profile.user_credentials.password`, `salesforce_profile.user_credentials.security_token` and `salesforce_profile.oauth2_client_credentials.client_secret` as sensitive in `google_datastream_connection_profile` (beta)

looker: marked `oauth_config.client_secret` as sensitive in `google_looker_instance`

developerconnect: marked `custom_oauth_config.client_secret` as sensitive in `google_developer_connect_account_connector`

identityplatform: marked `client_secret` as sensitive in `google_identity_platform_default_supported_idp_config`, `google_identity_platform_oauth_idp_config`, `google_identity_platform_tenant_default_supported_idp_config` and `google_identity_platform_tenant_oauth_idp_config`

dialogflow: marked `generic_web_service.password` as sensitive in `google_dialogflow_fulfillment` and `fulfillment.generic_web_service.password` as sensitive in `google_dialogflow_environment`

dialogflowcx: marked `generic_web_service.oauth_config.client_secret` and `service_directory.generic_web_service.oauth_config.client_secret` as sensitive in `google_dialogflow_cx_webhook`

integrations: marked the credential fields under `decrypted_credential` and `client_certificate` as sensitive in `google_integrations_auth_config`

cloudbuild: marked `api_key` as sensitive in `google_cloudbuild_bitbucket_server_config`

vmwareengine: marked `password` as sensitive in the `google_vmwareengine_nsx_credentials` and `google_vmwareengine_vcenter_credentials` data sources

apigee: marked `password` as sensitive in `google_apigee_keystores_aliases_pkcs12`

[github-actions]

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@rileykarson, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

[github-actions]

@rileykarson This PR has been waiting for review for 3 weekdays. Please take a look! Use the label disable-review-reminders to disable these notifications.