scylla-manager: harden alternator creds task (no_log, best-effort, TLS)

Address review on #537:
- Add no_log: true to the salted-hash fetch and both sctool add/update
  tasks so the alternator secret (and username/password) no longer leak
  into Ansible logs, -vvv output, or callback plugins.
- Make the cqlsh salted-hash lookup best-effort with failed_when: false
  so TLS-only clusters or transient auth/network failures skip the
  optional --alternator-* flags instead of aborting the whole add/update.
- Support client encryption via optional item.ssl (--ssl) for the lookup.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: ManjotS

ansible-scylla-manager/tasks/add_cluster.yml

@@ -11,9 +11,15 @@
 - name: Fetch alternator salted hash for "{{ item.username }}"
   shell: |
     cqlsh {{ item.host }} -u '{{ item.username }}' -p '{{ item.password }}' \
+      {% if item.ssl is defined and item.ssl|bool %}--ssl{% endif %} \
       -e "SELECT salted_hash FROM system.roles WHERE role = '{{ item.username }}';" \
       | grep -E '^\s+\$' | tr -d ' '
   register: alternator_salted_hash
+  # Alternator creds are best-effort: TLS-only clusters, transient network/auth
+  # failures, or missing SELECT on system.roles must not abort the cluster add/update.
+  failed_when: false
+  # stdout is a credential-equivalent secret; keep it out of Ansible logs/-vvv output.
+  no_log: true
   when:
     - item.username is defined
     - item.password is defined
@@ -36,6 +42,8 @@
       --alternator-access-key-id {{ item.username }} \
       --alternator-secret-access-key '{{ alternator_salted_hash.stdout }}' \
       {% endif %}
+  # Command line embeds username/password and the alternator secret; suppress logging.
+  no_log: true
   when: cluster_already_added is not defined or cluster_already_added.stdout != "present"
 
 - name: Enforce configuration for existing cluster "{{ item.cluster_name }}"
@@ -55,5 +63,7 @@
       --alternator-access-key-id {{ item.username }} \
       --alternator-secret-access-key '{{ alternator_salted_hash.stdout }}' \
       {% endif %}
+  # Command line embeds username/password and the alternator secret; suppress logging.
+  no_log: true
   when: cluster_already_added is defined and cluster_already_added.stdout == "present"