Terraform secret redaction misses the name/value-pair idiom (AWS environment/secrets lists)

[safishamsi]

Follow-up from #3762 (which extended secret redaction to list values).

The redaction keys off the attribute/map KEY matching _SENSITIVE_KEY_RE (password/secret/token/…). It does not catch the AWS name/value-pair idiom where the sensitive info is in a value paired with a name:

environment = [
  { name = "DB_PASSWORD", value = "hunter2" },   # value leaks
]
secrets = [{ name = "API_KEY", valueFrom = "..." }]

Here the map keys are literally name/value/valueFrom — none match the sensitive-key set — so hunter2 is captured into graph.json and the MCP surface verbatim. This is a pre-existing limitation of key-name matching (the map form x = { name = "PASSWORD", value = "..." } misses it too), not a regression from #3762; #3762 correctly closed the list-recursion gap it targeted.

Fix idea: when a map/object has both a name-like key and a value/valueFrom key, and the name's literal value matches _SENSITIVE_KEY_RE, redact the paired value. Scope to ECS/Batch containerDefinitions[].environment/secrets and the generic [{name,value}] shape. Keep it conservative (only redact when the name literal is clearly a secret) to avoid over-redacting ordinary name/value config.