Write-only attribute support for secret-bearing fields (Access IdP client_secret, Workers secret_text bindings)

[seanb4t]

Terraform 1.11+ write-only arguments let ephemeral values (e.g. Vault reads) flow into resources without persisting secrets in state. The provider currently has no write-only attributes: zero_trust_access_identity_provider config.client_secret and workers script/version secret_text binding text are plain Sensitive attributes.

I understand 5.6.0 briefly made config.client_secret write-only and it was reverted (#5702, #5748) due to state-upgrade and OpenTofu issues — is a _wo-suffixed companion attribute (the pattern hashicorp providers use, avoiding the in-place breaking change) something you'd consider? Related: #6964.

[jeszican]

+1 missing write-only arguments is blocking me from moving my secrets into terraform - which i would like to do. :)

[jeszican]

I created a PR for this here: #7247