Add pillar_mask_output config option and fix full-value pillar masking

[Akm0d]

VCOPS-98852: harden pillar output masking (VCOPS-77716, VCOPS-84671).

• salt.utils.secret.serial() only redacted non-empty strings; truthy int/float/bool and non-empty bytes leaked through pillar.get() and related functions with their real value even though the repr path already redacted those types. Extracted a shared _is_redactable_scalar() predicate used by both _masked_repr() and serial() so the two can't drift apart again.
• Added the pillar_mask_output master/minion config option (default True) as a global killswitch, seeded via salt.utils.secret.configure() from salt.pillar.get_pillar()/get_async_pillar(). When False, hide()/serial()/mask_output() no-op and pillar values are never wrapped or redacted.
• Documented pillar_mask_output in doc/ref/configuration/master.rst.
• Updated tests that encoded the old (buggy) passthrough behavior and added coverage for bytes redaction and the new config toggle.

What does this PR do?

What issues does this PR fix or reference?

Fixes

Previous Behavior

Remove this section if not relevant

New Behavior

Remove this section if not relevant

Merge requirements satisfied?

[NOTICE] Bug fixes or features added to Salt require tests.

• Docs
• Changelog - https://docs.saltproject.io/en/master/topics/development/changelog.html
• Tests written/updated

Commits signed with GPG?

Yes/No

[twangboy]

You got some failing tests

[perfecto25]

I submitted duplicate PR for same pillar mask global override, closed it now

#69834

[twangboy]

Wait until the nightlies are green before rebasing. The fix is in 3006.x and needs to merge forward.
Or cherry-pick #69929 (3478c0f) into your PR.

[dwoz]

@Akm0d

What happens if pillar_mask_output: False in the minion config and someone does

salt-call pillar.items unmask=False?

[Akm0d]

@Akm0d

What happens if pillar_mask_output: False in the minion config and someone does

salt-call pillar.items unmask=False?

Explicit unmask=False wins — the output stays masked (**********), regardless of pillar_mask_output: False in the minion config.

Here's why, in salt/modules/pillar.py's items():

if unmask is None:
    # pillar_mask_output only changes items()'s *default*...
    unmask = not salt.utils.secret.mask_pillar.get() or not __opts__.get(
        "pillar_mask_output", True
    )
if unmask:
    return salt.utils.secret.expose(ret)
else:
    return salt.utils.secret.serial(ret)

The pillar_mask_output config check only runs inside if unmask is None: — i.e., it only supplies a default when the caller doesn't pass unmask at all. Since your example passes unmask=False explicitly, that whole branch is skipped, and execution goes straight to else: return serial(ret) — redacted output.

So the config option's only effect is on the default behavior of a bare pillar.items call with no unmask kwarg. An explicit unmask=False (or unmask=True) always overrides it in either direction — pillar_mask_output can't force masking back on if someone explicitly asks for unmask=True, and it can't force unmasking if someone explicitly asks for unmask=False.