[FLINK-40539][sql-gateway] Redact sensitive values in SET; and session config responses

[gaborgsomogyi]

What is the purpose of the change

The SQL Gateway seeds each session's configuration with a full clone of the cluster configuration (loaded from config.yaml), which needs redaction:

• Executing a bare SET; statement returns every session/table config entry as result rows (OperationExecutor#callSetOperation).
• GET /sessions/:sessionHandle returns the session configuration as-is (GetSessionConfigHandler).

Brief change log

• OperationExecutor#callSetOperation now passes the configuration map through ConfigurationUtils#hideSensitiveValues before building the SET; result rows, mirroring ConfigurationInfo#from.
• GetSessionConfigHandler#handleRequest now redacts sensitive keys in the session configuration before returning it in the GET /sessions/:sessionHandle response. The redaction is applied only at this REST response boundary, not inside Session#getSessionConfig/SqlGatewayServiceImpl#getSessionConfig, since those are also used internally (e.g. materialized table script deployment, result timezone conversion) where the real, unredacted values are required.

Verifying this change

This change added tests and can be verified as follows:

• Added SqlGatewayServiceStatementITCase#testSetHidesSensitiveValues, which sets a sensitive key (s3.secret-key) via SET, executes a bare SET;, and asserts the returned value is masked.
• Added SessionRelatedITCase#testGetSessionConfigurationHidesSensitiveValues, which opens a session with a sensitive property and asserts GET /sessions/:sessionHandle returns the masked value.
• Both tests were verified to fail against the unpatched code (returning the cleartext secret) and pass after the fix.
• Ran SqlGatewayServiceITCase, SqlGatewayServiceStatementITCase, SqlGatewayRestEndpointStatementITCase, and SessionRelatedITCase in full to confirm no regressions in existing SET/RESET/session-config behavior.

Does this pull request potentially affect one of the following parts:

• Dependencies (does it add or upgrade a dependency): no
• The public API, i.e., is any changed class annotated with @Public(Evolving): no
• The serializers: no
• The runtime per-record code paths (performance sensitive): no
• Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: no
• The S3 file system connector: no

Documentation

• Does this pull request introduce a new feature? no
• If yes, how is the feature documented? not applicable

---

Was generative AI tooling used to co-author this PR?

• Yes (Claude Code)

[flinkbot]

CI report:

• 8ca1ee5 Azure: SUCCESS

Bot commands

The @flinkbot bot supports the following commands:

• @flinkbot run azure re-run the last Azure build