Move password-redaction filter to a standalone script

Inline python3 -c couldn't be indented to match entrypoint.sh's style
without breaking Python's indentation-sensitive syntax. Move it to
redact_secret.py (picked up by the existing COPY . /app/ in the
Dockerfile) so both files keep normal, consistent indentation.

Author: szachovy

services/superset/entrypoint.sh

@@ -5,18 +5,8 @@ set -euo pipefail
 DB_PASSWORD=$(< /run/secrets/mysql_superset_password)
 DB_URI="mysql+mysqlconnector://superset:${DB_PASSWORD}@${VIRTUAL_IP_ADDRESS}:6446/superset"
 
-# -x stays off here: tracing this line, or superset test_db's own "SQLAlchemy
-# URI" printout, would put the plaintext DB password into docker logs/docker
-# service logs. Redact stdout+stderr as a backstop in case anything
-# downstream still echoes the URI.
 if superset test_db "$DB_URI" --connect-args {} 2>&1 \
-    | DB_PASSWORD="$DB_PASSWORD" python3 -c '
-import os, sys
-pw = os.environ["DB_PASSWORD"]
-for line in sys.stdin:
-    sys.stdout.write(line.replace(pw, "<redacted>"))
-    sys.stdout.flush()
-'; then
+    | DB_PASSWORD="$DB_PASSWORD" python3 /app/redact_secret.py; then
   set -x
 
   superset fab create-admin \

services/superset/redact_secret.py

@@ -0,0 +1,8 @@
+#!/usr/bin/env python3
+import os
+import sys
+
+pw = os.environ["DB_PASSWORD"]
+for line in sys.stdin:
+    sys.stdout.write(line.replace(pw, "<redacted>"))
+    sys.stdout.flush()