Fix/set sensitive escaped dots (fixes #737 #1788)

[Angel-4903]

Problem

set_sensitive values were not being redacted in Terraform plan/state
output when the key contained an escaped dot (e.g. foo\.bar).

This is a security bug — secrets passed via set_sensitive with escaped-dot
keys appeared in plaintext in terraform plan, terraform apply output, and
stored state.

Reproducer

set_sensitive = [
  {
    name  = "foo\\.bar"
    value = "my-secret"
  }
]

## Root Cause

\`cloakSetValue()\` previously used \`strings.Split(path, \".\")\` to parse the key path.
A key like \`foo\\.bar\` was incorrectly split into \[\`foo\\\`, \`bar\`\] so the walk
silently failed and the real secret value remained visible in state.

## Fix

- Added \`splitKeyPath()\` in \`helm/strvals_helpers.go\` — correctly treats \`\\.\`
  as a literal dot within a key name, not a path separator.
- Updated \`cloakSetValue()\` in \`resource_helm_release.go\` to use \`splitKeyPath()\`.
- Updated \`cloakSetValueModel()\` in \`data_helm_template.go\` to use \`splitKeyPath()\`
  (same bug existed for the \`helm_template\` data source).

## Tests

- \`TestSplitKeyPath\` — table-driven, 10 cases covering all escaping edge cases.
- \`TestCloakSetValue\` — table-driven, 4 cases: plain key, dotted key,
  escaped-dotted key, and nested key.

Fixes #737
Fixes #1788"

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

---

1 out of 2 committers have signed the CLA.

• atmask
• Angel Raphael

---

Angel Raphael seems not to be a GitHub user.
You need a GitHub account to be able to sign the CLA.
If you have already a GitHub account, please add the email address used for this commit to your account.

_{Have you signed the CLA already but the status is still pending? Recheck it.}