<fix>[core]: add @NoLogging to sensitive config fields

[ZStack-Robot]

Resolves: ZSTAC-80664\n\nAdd @nologging annotation to prevent sensitive configuration data from being logged.

sync from gitlab !9171

[coderabbitai]

Walkthrough

新增对 ExternalPrimaryStorageInventory 中 config 内容的脱敏处理：在构造器调用了 desensitizeConfig，新增了三处私有方法（desensitizeConfig、desensitizeUrlList、desensitizeUrl）以及必要的导入，逻辑会对 mdsUrls/mdsInfos 列表中的 URL 在 @ 之后进行遮蔽。

Changes

Cohort / File(s)	Summary
脱敏逻辑 header/src/main/java/org/zstack/header/storage/addon/primary/ExternalPrimaryStorageInventory.java	添加 ArrayList/Map 导入；在 ExternalPrimaryStorageInventory(ExternalPrimaryStorageVO) 中对 config 调用 desensitizeConfig(config)；新增私有方法 desensitizeConfig(Map), desensitizeUrlList(Map,String) 和 desensitizeUrl(String)，对 mdsUrls 与 mdsInfos 中的 URL 在 @ 后部分替换为 "***"。

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

诗歌

🐰 我在配置里轻轻嗅，
把秘密用星星藏在后，
mds 的路徑被遮掩，
数据静静更温柔，
兔子在角落眨眨眼。

🚥 Pre-merge checks | ✅ 3 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	PR标题格式符合[scope]: 要求，长度54字符在72字符限制内，且明确反映了实际的代码变更内容（添加敏感配置字段的反序列化逻辑）。
Description check	✅ Passed	PR描述与代码变更相关，提到了防止敏感配置数据被记录的目标，且包含JIRA问题号ZSTAC-80664和同步源信息。
Merge Conflict Detection	✅ Passed	✅ No merge conflicts detected when merging into 5.5.6

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch sync/ye.zou/fix/ZSTAC-80664

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In
`@header/src/main/java/org/zstack/header/storage/addon/primary/ExternalPrimaryStorageInventory.java`:
- Around line 91-95: The desensitizeUrl method currently strips the protocol
(e.g., turning "iscsi://user:pass@host" into "***@host"); update desensitizeUrl
so it preserves the scheme/protocol prefix (everything up to and including
"://") and only masks the credentials portion before the '@' (replace credential
characters with "***" or similar) while keeping the rest of the URL intact;
locate and modify the desensitizeUrl method to detect the "://" delimiter and
the last '@' (using the existing atIndex logic) and build the returned string as
protocol + maskedCredentials + substring(from atIndex) so callers depending on
protocol parsing keep backward-compatible behavior.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

脱敏后丢失协议前缀，可能破坏兼容性。

当前逻辑会把 iscsi://user:pass@host 变成 ***@host，协议头丢失，容易影响依赖协议解析的客户端或历史行为。建议保留协议前缀，仅遮蔽凭据段。

🛠️ 保留协议前缀的修复建议

 private static String desensitizeUrl(String url) {
     int atIndex = url.lastIndexOf('@');
     if (atIndex > 0) {
-        return "***" + url.substring(atIndex);
+        int schemeIndex = url.indexOf("://");
+        if (schemeIndex >= 0 && schemeIndex < atIndex) {
+            String prefix = url.substring(0, schemeIndex + 3);
+            return prefix + "***" + url.substring(atIndex);
+        }
+        return "***" + url.substring(atIndex);
     }
     return url;
 }

As per coding guidelines: “向后兼容原则：之前的代码产生的行为不要直接去改动…”

🤖 Prompt for AI Agents

In
`@header/src/main/java/org/zstack/header/storage/addon/primary/ExternalPrimaryStorageInventory.java`
around lines 91 - 95, The desensitizeUrl method currently strips the protocol
(e.g., turning "iscsi://user:pass@host" into "***@host"); update desensitizeUrl
so it preserves the scheme/protocol prefix (everything up to and including
"://") and only masks the credentials portion before the '@' (replace credential
characters with "***" or similar) while keeping the rest of the URL intact;
locate and modify the desensitizeUrl method to detect the "://" delimiter and
the last '@' (using the existing atIndex logic) and build the returned string as
protocol + maskedCredentials + substring(from atIndex) so callers depending on
protocol parsing keep backward-compatible behavior.