security: remove clear-text exception logging in secrets backend (alert 53)

[abhihashi]

Summary

Fixes code scanning alert #53 — clear-text logging of sensitive information at grove/secrets/__init__.py:74.

Root cause

The exception object was passed directly into the structured log extra dict inside the AccessException / IndexError handler. Secret backends (AWS Secrets Manager, Vault, etc.) can echo credential paths or values back inside their error messages. Binding err to extra caused the full exception string — potentially including secret material — to be emitted as clear-text in every log pipeline.

Change

- except (AccessException, IndexError) as err:
+ except (AccessException, IndexError):
      self.logger.error(
          "Unable to get secret for connector, skipping",
          extra={
              "document": configuration.name,
              "field": field,
-             "exception": err,
          },
+         exc_info=False,
      )

• Removes exception: err from extra so no secret material enters the log record.
• Sets exc_info=False explicitly to prevent the logger from attaching the traceback (which could also carry the exception message) via a parent handler configured with exc_info=True.