🤔 Problem: In #1523, we made it so that the buildkite-agent pipeline upload command would reject any pipeline yaml that had sensitive values in it. We shipped this as part of v3.34. This is an awesome security feature, and prevents a bunch of footguns, but unfortunately it's a breaking change, and we accidentally shipped it as part of a minor release.

✅ Solution: This PR reverts default redaction behaviour to how it was previously, with some slight changes:

• The newer behaviour (rejecting a pipeline upload if there's juicy secrets in it) is available with the --reject-secrets flag
• Even when the --reject-secrets flag isn't used, the command issues a warning that:
  • There are unredacted secrets in the pipeline
  • and that default behaviour in agent v4 will be to reject these pipeline uploads

Slightly related, it makes the --dry-run flag for the pipeline upload command work with redaction.

Screenshots:
Without --reject-secrets:

With --reject-secrets:

These are from my local machine using the --dry-run flag, using this pipeline:

steps:
  - label: ":hammer: Example Script"
    command: "echo $COOL_PASSWORD"
    artifact_paths: "artifacts/*"
    agents:
      queue: "${BUILDKITE_AGENT_META_DATA_QUEUE:-default}"

Closes #1578
Closes PIP-309