fix(security): keep secrets out of the container log

[DeepDiver1975]

Split out of #542 so the security fix can be reviewed and merged on its own — it
is independent of the app/marketplace changes that remain there and touches no
file they touch except CHANGELOG.md.

Scoped to v22.04 and v24.04; v20.04 is dormant and untouched.

Secrets no longer reach the log (#541)

DEBUG=true printed the admin and database passwords ten times per startup:

+ occ maintenance:install ... --database-pass DbSecret456 ... --admin-pass SuperSecret123
+ [[ -z DbSecret456 ]]

Fixed by building the install arguments in a quoted array with xtrace off around
the credential options, testing the secret env defaults as "${VAR:+x}" so the
trace shows x instead of the value, and not tracing the occ argument list in
/usr/bin/occ (the caller already traces its own occ ... line).

Covers OWNCLOUD_ADMIN_PASSWORD, OWNCLOUD_DB_PASSWORD,
OWNCLOUD_REDIS_PASSWORD, OWNCLOUD_MAIL_SMTP_PASSWORD, OWNCLOUD_SECRET,
OWNCLOUD_OBJECTSTORE_KEY, OWNCLOUD_OBJECTSTORE_SECRET and
OWNCLOUD_LICENSE_KEY.

Side effect: an admin password containing a space now works. The unquoted
${COMMAND} word-split it, so maintenance:install aborted with
No arguments expected for "maintenance:install" command, got "with".

Known limitation: the passwords are still in the occ process argv, so ps
inside the container and admin_audit's command_executed entries can see them.
maintenance:install has no env-var equivalent for --admin-pass. Two related
leaks are core-side and out of scope here: admin_audit logging the full occ
argv, and config:system:set echoing the value back to stdout (both visible in
the reporter's log for wopi.token.key).

Verification

Ran against owncloud/server:10.16.4 with this overlay layered in (sqlite, no
DB container):

	result
DEBUG=true with 5 secrets set	0 secret hits in the log (was 10), xtrace still active after the install
OWNCLOUD_ADMIN_PASSWORD='pw with space'	installs; PROPFIND returns 207 with the full password and 401 with pw

shellcheck clean on every touched script.

🤖 Generated with Claude Code