RFE: Add no_log_password to production profile

[djdanielsson]

I would like to push the idea of adding the no_log_password into production profile default list. I think this seems exactly like the type of rule that "production" ready code should not be leaking passwords within loops.

[jeffcpullen]

This rule is really specific, only looking at the ansible.builtin.user module when the "password" parameter is included. I agree that it should be included production profile.

I think the larger discussion though is that this very narrow rule doesn't capture the overwhelming majority of other situations where a password might be logged. For example this rule would miss community.hashi_vault.vault_login with "password" set, or community.aws.secretsmanager_secret with "access_key" provided.

[branic]

I agree as well that the rule should be added to the production profile and as @jeffcpullen said it would be great if the coverage could be extended to other modules, maybe even pretty generalized where it is looking for keys like password, access_key, secret_access_key, and similar.

As it would be impossible to have a list of every sensitive key maybe the rule name could be changed (or another rule added) to something like no-log-sensitive and the list of keys to look for could be augmented (or specified) by the users configuration.