Preserve YAML-sensitive characters in Redis Sentinel passwords
Redis Sentinel passwords containing a quote, backslash, or newline are not preserved by the runtime YAML templates. The password helper emits unencoded ERB, and the Rails, exporter, and Mailroom templates put double quotes around it before ERB evaluation.
A password such as quote"value or back\slash makes the generated YAML invalid. A password with an embedded newline is parsed with the newline folded into a space.
I reproduced this on current master with Helm rendering followed by the existing RuntimeTemplate ERB helper and YAML parsing. Of eight cases, the five plain/control values pass; the quote, backslash, and newline cases fail. The regression covers webservice, sidekiq, toolbox, gitlab-exporter, and both incoming-email and Service Desk Mailroom options.
The fix is to encode the password with .to_json inside the shared ERB interpolation and remove the outer quotes in its consumers. This follows the chart style guide for sensitive content. It does not change when Sentinel authentication is enabled or how the secret is mounted.
Related: the Sentinel finding is mentioned as outside the scope of #6689 (closed). This issue tracks that separate fix; the registry notification secret is handled in !5449 (merged).
AI assistance: investigated with OpenAI Codex. The reproduction above was run locally; live cluster validation remains pending.