Fix run_winexe_command leaking plaintext password in logs

[ggiesen]

What does this PR do?

Corrects the order of two assignments in run_winexe_command (salt/utils/cloud.py) so the redacted logging_command is built from the original cmd before cmd is reassigned to the full command line. Previously the logging string interpolated the already-built command, which doubled the winexe prefix and embedded the real plaintext password in the logged output. The actually executed command is unchanged; this is a logging/security fix.

What issues does this PR fix or reference?

Fixes #54910

Previous Behavior

run_winexe_command reassigned cmd to the full command line before building logging_cmd, so the "redacted" log line interpolated the already-built command:

[INFO ] Running command under pid 10714: 'winexe -U 'Administrator%XXX-REDACTED-XXX' //1.1.1.1 winexe -U 'Administrator%<plaintext>' //1.1.1.1 sc query winexesvc query winexesvc'

The intended XXX-REDACTED-XXX redaction was defeated: the second, embedded winexe -U fragment carried the real password, and it was written to both the INFO and DEBUG log lines.

New Behavior

The logged command is derived from the original inputs and contains a single, fully redacted credential:

winexe -U 'Administrator%XXX-REDACTED-XXX' //1.1.1.1 sc query winexesvc

The plaintext password no longer appears in any log line. The executed command is identical to before.

Merge requirements satisfied?

• Docs (n/a - internal utility behaviour, no doc-facing change)
• Changelog (changelog/54910.fixed.md)
• Tests written/updated - added to tests/pytests/unit/utils/test_cloud.py:
  • test_run_winexe_command_redacts_password_54910 - asserts the logging_command passed to win_cmd is fully redacted, contains no plaintext password, and has a single winexe -U credential fragment (the regression check).
  • test_run_winexe_command_executes_correct_command_54910 - must-not-regress: the executed command is still correct (passes with and without the fix).
  • test_run_winexe_command_returns_win_cmd_result - the win_cmd return value is propagated to the caller.

[NOTICE] Commits signed with GPG?: No

[dwoz]

We handled this in the cmd.py module by never logging any arguments. We only ever log the the program name being run.

[ggiesen]

Thanks @dwoz - good call, that's cleaner than redacting. Switched run_winexe_command to hand win_cmd just the program name ("winexe") as the logged command, so the arguments - credentials and all - never reach the logs, matching the salt.modules.cmdmod._log_cmd convention. Updated the test to assert only the program name is logged, and dropped the redaction entirely.