Codebuild secret preservation

[gthole]

Fixes #4720

Changes proposed in this pull request:

• Only set the secret attribute on resource creation, since it's never returned again from the AWS API after creation (despite what the API docs say.)
• Make the secret attribute sensitive.
• Add extra steps to GithubEnterprise test to confirm update mechanism successfully modifies the branchFilter without losing the the secret.

Output from acceptance testing:

$ make testacc TESTARGS='-run=TestAccAWSCodeBuildWebhook'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./... -v -run=TestAccAWSCodeBuildWebhook -timeout 120m
?       github.com/terraform-providers/terraform-provider-aws   [no test files]
=== RUN   TestAccAWSCodeBuildWebhook_GitHub
--- PASS: TestAccAWSCodeBuildWebhook_GitHub (21.37s)
=== RUN   TestAccAWSCodeBuildWebhook_GitHubEnterprise
--- PASS: TestAccAWSCodeBuildWebhook_GitHubEnterprise (35.58s)
=== RUN   TestAccAWSCodeBuildWebhook_BranchFilter
--- PASS: TestAccAWSCodeBuildWebhook_BranchFilter (32.86s)
PASS
ok      github.com/terraform-providers/terraform-provider-aws/aws       89.836s

NB: To get the Github cases to pass, I modified the codebuild_project location to point to my fork of hashibot-test/aws-test.git. That change is not reflected in the committed code.

[bflad]

LGTM -- thanks for this fix @gthole! 🚀

[bflad]

This has been released in version 1.23.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!