Test: secrets flowing into first-class providers

[t0yv0]

#164 needs some follow-up tests on secrets passed via first-class provider as in:

const provider = new bucket.Provider("test-provider", {
    aws: {
        "region": pulumi.secret("us-west-2") // opentofu provider configuration
    }
})

const m = new bucket.Module("mymod", {}, {provider: provider});

We need to make sure that TOFU receives the un-secreted value, that secret does not leak into the statefile. There may be some complication here due to JSON-encoding of config values, where TypeScript and YAML programs behave differently.