Redact Terraform-sensitive resource attributes in run plan/apply diffs

## Summary

When Terraform marks a resource attribute as Sensitive (e.g. okta_app_oauth.client_secret, using the Okta provider), Spacelift run UI still shows the plaintext value in the resource create/update diff. We expected the same redaction the tofu CLI uses: (sensitive value).

## Why it matters

OIDC client secrets (and similar provider-computed secrets) are visible to anyone who can view the Spacelift run. That expands the blast radius beyond state access and makes it harder to share run links / screenshots safely. Our module already marks the output as sensitive; the gap is in the resource attribute diff rendering.

## Reproduction

1. Apply a stack that creates okta_app_oauth (confidential client; omit_secret left at default false).

2. Open the Spacelift run and inspect the resource changes for the OIDC app.

3. Observe client_secret shown as a raw string in the diff, e.g.:

+ client_secret: "..."

instead of:

+ client_secret: (sensitive value)

## Expected

Any attribute Terraform reports as sensitive should be redacted in:

- plan diffs

- apply diffs

- related run log / change views in the Spacelift UI

State may still contain the value (Terraform limitation), but the UI should not display it in plaintext when sensitivity metadata is present.

## Ask

Please redact Sensitive resource attributes in Spacelift run diffs/logs using Terraform’s sensitivity metadata, consistent with terraform plan/apply CLI behavior.