[DSIP-105][API] Encrypt sensitive definition params with PasswordUtils

[det101]

Purpose

Implements #18587 (subtask of #17937 / DSIP-105). Depends on #18586 / #18585.

Reuse PasswordUtils for definition-time at-rest protection of sensitive=true values when datasource.encryption.enable=true. Do not change datasource CRUD. Runtime instance params stay plaintext materialization; API/UI still return masked copies only.

Changes

• Definition create/update: merge keep-original (******) then encode new sensitive plaintext; skip re-encode when value equals existing sensitive DB value
• Instance update: merge only (no encode)
• Start path: decrypt definition globals before restoreStartParams
• Master: decrypt definition globals before instance materialization; decrypt localParams in TaskExecutionContext / prepare-params so Worker receives plaintext
• Same-cluster Copy unchanged (JSON copied as-is)

Tests

• Unit tests for encode on create, keep-original no double-encrypt, false→true keep-original then encode, encryption flag on/off, start-path decrypt, Master localParams decrypt

Related issues

• Parent: [DSIP-105][Feature][Parent] Sensitive Variable Support — Masking in API/UI & Encrypted Storage #17937
• This subtask: [DSIP-105][Feature][API] Encrypt sensitive definition params with PasswordUtils #18587
• Previous: [DSIP-105][Feature][API] Add Property.sensitive and mask values in API/UI #18586 / [DSIP-105][API][UI] Add Property.sensitive with API/UI masking #18585

[SbloodyS]

Encrypt definition snapshots created by instance edits

updateWorkflowInstance() is not an instance-only persistence path. It calls saveTaskDefine() and saveWorkflowDefine(), which write definition history even when syncDefine=false and also update current definitions when syncDefine=true.

Passing false to mergeLocalParams() therefore persists newly entered sensitive local values as plaintext in definition tables. The merged runtime globalParams are also passed directly into workflowDefinition.set(), so even keeping an existing sensitive global unchanged can copy its plaintext instance value back into the definition.

Please preserve plaintext instance globals while encrypting the copies persisted as task/workflow definitions. Add service-level coverage for instance edits with encryption enabled and both syncDefine values; the new utility tests do not cover this persistence path.