make computed env sensitive

Author: johnstcn

docs/resources/cached_image.md

@@ -47,7 +47,7 @@ The cached image data source can be used to retrieve a cached image produced by
 
 ### Read-Only
 
-- `env` (List of String) Computed envbuilder configuration to be set for the container.
+- `env` (List of String, Sensitive) Computed envbuilder configuration to be set for the container. May contain secrets.
 - `exists` (Boolean) Whether the cached image was exists or not for the given config.
 - `id` (String) Cached image identifier. This will generally be the image's SHA256 digest.
 - `image` (String) Outputs the cached image repo@digest if it exists, and builder image otherwise.

internal/provider/cached_image_resource.go

@@ -196,9 +196,10 @@ func (r *CachedImageResource) Schema(ctx context.Context, req resource.SchemaReq
 			// Computed "outputs".
 			// TODO(mafredri): Map vs List? Support both?
 			"env": schema.ListAttribute{
-				MarkdownDescription: "Computed envbuilder configuration to be set for the container.",
+				MarkdownDescription: "Computed envbuilder configuration to be set for the container. May contain secrets.",
 				ElementType:         types.StringType,
 				Computed:            true,
+				Sensitive:           true,
 			},
 			"exists": schema.BoolAttribute{
 				MarkdownDescription: "Whether the cached image was exists or not for the given config.",