Don't show diffs by default

[TheMeier]

file resources in this module should set show-diff to false by default, since there is a high likelihood that files rendered by this module contain secrets

[ekohl]

Would it make sense to use Sensitive where possible? That way it automatically gets redacted if needed.

[TheMeier]

Given the very generic template, I don't immediately see how one would do that.

[ekohl]

EPP has special handling for Sensitive so if a users pass in any Sensitive instead of plain String I'd expect it to already do that.