Redacting sensitive HTTP responses lost in orchestrator migration

[jdisanti]

The middleware implementation had a sensitive() function on the ParseHttpResponse trait that would conditionally redact logging of the HTTP response. This was lost during the orchestrator implementation and needs to be ported over.

Old implementation:
https://github.com/awslabs/smithy-rs/blob/2d61502221d446695f6a0ff9799352ab38ad31cd/rust-runtime/aws-smithy-http/src/response.rs#L64-L69
https://github.com/awslabs/smithy-rs/blob/2d61502221d446695f6a0ff9799352ab38ad31cd/rust-runtime/aws-smithy-http/src/middleware.rs#L137-L145

[ysaito1001]

The reason credentials exposure detection tests added in #2603 still pass in the orchestrator, even though we haven't ported the pieces of code above to the orcestrator, is that even in the orchestrator, code execution paths still go through aws_smithy_http::middleware::load_response.

As of today, CredentialsProviders in aws_config, such as ImdsCredentialsProvider and HttpCredentialProvider, use a smithy client with middleware (example). This means the pieces of code above are used even in the orchestrator.

Only after middleware has been removed, do credentials exposure detection tests start failing in the orchestrator.

UPDATE
Regarding the statement above

Only after middleware has been removed, do credentials exposure detection tests start failing in the orchestrator.

The tests won't fail because in the orchestrator we do not print request bodies. If we changed the following code in try_attempt in the orchestraor

        match maybe_deserialized {
            Some(output_or_error) => output_or_error,
            None => read_body(response)
                .instrument(debug_span!("read_body"))
                .await
                .map_err(OrchestratorError::response)
                .and_then(|_| {
                    let _span = debug_span!("deserialize_nonstreaming").entered();
                    response_deserializer.deserialize_nonstreaming(response)
                }),
        }

to

        match maybe_deserialized {
            Some(output_or_error) => output_or_error,
            None => read_body(response)
                .instrument(debug_span!("read_body"))
                .await
                .map_err(OrchestratorError::response)
                .and_then(|_| {
                    let _span = debug_span!("deserialize_nonstreaming").entered();
                    trace!(response = ?response); // <--- adds this line to print the body
                    response_deserializer.deserialize_nonstreaming(response)
                }),
        }

then exposure tests will fail (so the tests are working in the orchestrator).