Allow any sensitive type so that Sensitive(Deferred(...)) values can be passed to concat::fragment

[nrhall]

Summary

Providing Sensitive(Deferred(...)) inputs to concat::fragment (where the deferred function returns a String) does not work in concat::fragment.

Additional Context

Given that Deferred types do work, it seems reasonable to allow these to also be Sensitive so you can handle things like secrets from Vault, or Sensitive deferred templates - however currently, concat::fragment only allows Sensitive[String], which can't be determined at compile time when there's a Deferred function to resolve.

This PR generalises it to allow just Sensitive; I appreciate this weakens the type-checking slightly, but allowing Deferred already seems to have similar issues (because you can't tell that it's a Deferred[String]), so hopefully this is acceptable.

Checklist

• 🟢 Spec tests.
• [ x ] 🟢 Acceptance tests.
• [ x ] Manually verified. (For example puppet apply)

[CLAassistant]

All committers have signed the CLA.

[nrhall]

Hi - wondered if anyone had a chance to look at this?