Add #[SensitiveParameter] attribute to sensitive parameters

[slknijnenburg]

Fixes #1081, adds #[SensitiveParameter] to all potentially sensitive parameters, including key material, certificates and passphrases.

I wondered if this would be a BC break, but it seems that that is not the case. Child classes/interface implementations can apparently omit the attribute without any problems.

[Slamdunk]

Thank you for this contribution.

As far as I know, #[SensitiveParameter] only makes sense in string parameters, please update the PR to only target:

1. \Lcobucci\JWT\Signer\Key\InMemory methods
2. \Lcobucci\JWT\Signer\OpenSSL::createSignature
3. \Lcobucci\JWT\Signer\OpenSSL::verifySignature

Also, as this can be considered a Bug please target the 5.4.x branch.

[Slamdunk]

Awesome, few final fixes and we can 🚢 it 💪

[TimWolla]

As far as I know, #[SensitiveParameter] only makes sense in string parameters

This is false. The attribute is agnostic to the parameter type and the Exception handler of your choice might opt to also process objects (e.g. by printing their __debugInfo()) output. The attribute should be apply to anything that is sensitive, independent of type.

[Slamdunk]

Mmm, by this logic everything is sensitive, if my debug handler dumps the entire memory and filesystem to the logger.

I think handling the default behaviour is enough for us.