chore(endpoint): harden AES-GCM encryption and remove sensitive data from logs

[ivankatliarchuk]

What does it do ?

• Reject empty nonce in EncryptText with explicit error instead of silently using all-zero nonce
• Fail fast — validate nonce before allocating cipher/GCM
• Use consistent NewGCMWithNonceSize in both encrypt and decrypt paths
• Change GenerateNonce return type from []byte to string to eliminate redundant type conversions
• Stop logging AES key and plaintext in Serialize error path
• Stop logging ciphertext in DecryptText debug path
• Remove logrus dependency from crypto.go
• labels.go -> Simplify with direct map lookup — no need for var declaration + extractedNonce temporary
• Simplify error messages to include data sizes instead of dumping full ciphertext

follow-up:

• more tests for this package

Motivation

• An empty nonce produces an all-zero GCM nonce which breaks AES-GCM's security guarantees if reused with the same key
• The log.Fatalf message in Serialize included the AES encryption key in plaintext, which would leak to any log aggregator
• Encrypt/decrypt used different GCM constructors (NewGCMWithNonceSize vs NewGCM) — functionally equivalent for 12-byte nonce today, but fragile if the constant ever
  changes
• Error messages dumped full ciphertext which is noisy and unhelpful for debugging

More

• Yes, this PR title follows Conventional Commits
• Yes, I added unit tests
• Yes, I updated end user documentation accordingly

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign szuecs for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coveralls]

Pull Request Test Coverage Report for Build 22016909606

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• 15 unchanged lines in 1 file lost coverage.
• Overall coverage increased (+0.009%) to 79.162%

---

Files with Coverage Reduction	New Missed Lines	%
crypto.go	15	67.9%

Totals
Change from base Build 21942518735:	0.009%
Covered Lines:	16039
Relevant Lines:	20261

---

💛 - Coveralls