Add a migration to encrypt database password using scram-sha-256

[bdunne]

Related:

• default encryption to scram-sha-256 manageiq-appliance#388
• Default the system password_encryption to scram-sha-256 manageiq-pods#1157

CP4AIOPS-3003

[Fryguy]

Note that if anyone has their database locally setup as md5 (or just on a old version), this will break their local database. I'm ok with that, but we might need some instructions either here or in guides/dev-setup on the changes needed to unbreak them.

[Fryguy]

There are cases where we could use DATABASE_URL, so I think it's better to use the database configuration instead. Additionally, database confiuguration should have already decrypted the password for us, so there's no need to further try_decrypt:

ActiveRecord::Base.connection_db_config.configuration_hash
# => {:adapter=>"postgresql", :encoding=>"utf8", :username=>"root", :pool=>"5", :wait_timeout=>5, :min_messages=>"notice", :database=>"vmdb_development", :password=>"smartvm", :port=>5432, :host=>"localhost"}

[bdunne]

Done

[kbrock]

I think the only concern here is the plaintext password will be printed into the pg logs in some cases. This is from what I've read and I have not researched/looked too deep into this

[Fryguy]

Backported to radjabov in commit 37e87fa.

commit 37e87fa519bb9df9f8fe41d9c005b9b1790b4a32
Author: Jason Frey <fryguy9@gmail.com>
Date:   Wed Oct 23 16:29:10 2024 -0400

    Merge pull request #757 from bdunne/scramsha
    
    Add a migration to encrypt database password using scram-sha-256
    
    (cherry picked from commit 3762bf55c1f5037c7e5421ec426ecbb9dad12fdb)

[Fryguy]

@kbrock the way it's done here encrypts the password first (in memory) then sends that, so it should not be in the logs