credentials are sensitive, mask them

The `sensitive` attribute for the template resource should be used when
rendering files that contain sensitive information such as credentials so they
are not output in chef-client runs.