refactor: Add log_std(out|err) bools to repo_utils that execute a subprocess

[dougthor42]

While making a local patch to work around #2640, I found that I had a need for running a subprocess (gcloud auth print-access-token) via repo_utils.execute_checked_stdout. However, doing so would log that access token when debug logging was enabled via RULES_PYTHON_REPO_DEBUG=1. This is a security concern for us, so I hacked in an option to allow a particular execute_(un)checked(_stdout) call to disable logging stdout, stderr, or both.

I figure this might be useful to others so I thought I'd upstream it.

execute_(un)checked(_stdout) now support log_stdout and log_stderr bools that default to True (which is the same behavior as before this PR.

When the subprocess writes to stdout and log_stdout = False, the logged message will show:

===== stdout start =====
<log_stdout = False; skipping>
===== stdout end =====

If the subprocess does not write to stdout, the debug log shows the same as before:

<stdout empty>

The above also applies for stderr, with text adjusted accordingly.

[dougthor42]

One alternative API option is to use a single string arg. Eg:

log_std = "both"  # one of ["both", "stdout", "stderr"]

(I'd prefer an enum but this is starlark not python 🫠)

LMK which API people would prefer or if you have another option in mind. And please suggest a better arg name than log_std haha.

[rickeylev]

I think the log_xxx API is fine. These are internal helpers, so easy to change if we want.

[dougthor42]

Any tips on how this should be tested?

[rickeylev]

I don't think we have any unit tests of these.

[rickeylev]

The repo_utils apis are internal, so no need to document this in the user-facing changelog.

[dougthor42]

Ack 👍, I'll keep that in mind for next time.

[rickeylev]

I don't think we have any unit tests of these.

[rickeylev]

I think the log_xxx API is fine. These are internal helpers, so easy to change if we want.