Backport of apply: include sensitive metadata when comparing changed input values into v1.13

[github-actions]

Backport

This PR is auto-generated from #37582 to be assessed for backporting due to the inclusion of the label 1.13-backport.

The below text is copied from the body of the original PR.

---

This PR updates the output for when input values have erroneously changed between plan and apply so that sensitive input values are hidden in the error message.

This approach just rechecks the actual configuration for sensitive values, and applies those marks to the rendered outputs. Interestingly, the plan itself does not contain the information from the configuration, even those it does have room for the marks to be added. This comment suggests that this is deliberate, so I didn't change that behaviour.

Another approach would be to change that behaviour and add the marks from the config during the plan stage, and then just apply the marks from the plan instead of rechecking the config. I was worried about unintended side effects etc, so I went with just rechecking the config but am happy to go and make the more complete change if anyone feels strongly about it.

Fixes #37563

Target Release

1.13.2

Rollback Plan

• If a change needs to be reverted, we will roll out an update to the code within 7 days.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

CHANGELOG entry

• This change is user-facing and I added a changelog entry.
• This change is not user-facing.

---

Overview of commits

• 317b6f1

• 0f03857