[DSIP-105][API] Encrypt sensitive definition params with PasswordUtils

[det101]

Purpose

Implements #18587 (subtask of #17937 / DSIP-105). Depends on #18586 / #18585.

Reuse PasswordUtils for definition-time at-rest protection of sensitive=true values when datasource.encryption.enable=true. Do not change datasource CRUD. Runtime instance params stay plaintext materialization; API/UI still return masked copies only.

Changes

• Definition create/update: merge keep-original (******) then encode new sensitive plaintext; skip re-encode when value equals existing sensitive DB value
• Instance update: merge only (no encode)
• Start path: decrypt definition globals before restoreStartParams
• Master: decrypt definition globals before instance materialization; decrypt localParams in TaskExecutionContext / prepare-params so Worker receives plaintext
• Same-cluster Copy unchanged (JSON copied as-is)

Tests

• Unit tests for encode on create, keep-original no double-encrypt, false→true keep-original then encode, encryption flag on/off, start-path decrypt, Master localParams decrypt

Related issues

• Parent: [DSIP-105][Feature][Parent] Sensitive Variable Support — Masking in API/UI & Encrypted Storage #17937
• This subtask: [DSIP-105][Feature][API] Encrypt sensitive definition params with PasswordUtils #18587
• Previous: [DSIP-105][Feature][API] Add Property.sensitive and mask values in API/UI #18586 / [DSIP-105][API][UI] Add Property.sensitive with API/UI masking #18585