fix: allow erasing write-only secrets with explicit null on PUT #1949

[KirylKurnosenka]

On a per-entity PUT update there was no way to erase a write-only secret: an explicit null was treated identically to an omitted field and silently preserved the stored ciphertext (see #1949 — once a JSON secretExtraData was stored, the upstream could never be switched to a plain-string extraData). This change makes the three update intents explicit: omitted → preserve, explicit null → erase, a literal value (including the empty string) → replace.

Applicable issues

• fixes Admin API: no way to erase a write-only secret on entity update (PUT) #1949

Description of changes

• SecretFieldProcessor.mergeInto: the preserve branch no longer treats an explicit null as omit — the request's NullNode now flows into the entity and the blob writer omits the field, so the erase carries end-to-end. Renamed mergePreservingOmittedSecrets → mergeUpdateSecrets to reflect the three-intent contract.
• ConfigResourceController.handlePut: updated call site and replaced the stale sentinel-era comment.
• Nested paths (Model.upstreams, Route.upstreams, Upstream.interfaces) are covered automatically by the existing recursion in mergeArray/mergeMap.
• Key.key is unchanged: an explicit null still yields 400 via validateKeyForApiWrite — erase does not apply to a mandatory field.
• An empty string stays a literal value, not an erase signal (pinned by a test).
• Tests: 5 new SecretFieldProcessorTest cases (top-level, upstream array element, interface map entry, empty string, null with no prior value); end-to-end ModelWriteApiTest.testPutExplicitNullUpstreamKeyErasesSecret (no X-UPSTREAM-KEY header after erase) and ConfigEntityWriteApiTest.testKeyPutExplicitNullKeyRejected400.
• OpenAPI: nullable: true + descriptions on the Upstream/UpstreamInterface secret fields documenting the three intents.

Checklist

• Title of the pull request follows Conventional Commits specification

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[ai-dial-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None