sync: ENCRYPTED_PREFIXES misses the GCP/Azure ciphertext variants

[padak]

Follow-up split out of #607 / PR #611 (kept out of that PR to keep the fix reviewable).

src/keboola_agent_cli/sync/secrets.py lists only the AWS-era cipher prefixes:

ENCRYPTED_PREFIXES: tuple[str, ...] = (
    "KBC::ProjectSecure::",
    "KBC::ComponentSecure::",
    "KBC::ConfigSecure::",
    "KBC::ProjectWideSecure::",
)

The Encryption API emits a different variant per cloud — KBC::ProjectSecureGKMS:: (GCP) and KBC::ProjectSecureKV:: (Azure Key Vault), verified live on connection.north-europe.azure.keboola.com. Neither is recognised here, so is_encrypted_value() returns False for a legitimately encrypted GCP/Azure value.

Impact is narrow, which is why it was not bundled into the #607 fix. The only consumer is sync/diff_engine.py::_normalize, which replaces encrypted values with ENCRYPTED_PLACEHOLDER so ciphertext does not show up as a diff. The dominant path there is is_secret_key(key) (the # prefix), which already covers every conventionally-named secret; only an encrypted value stored under a non-# key slips through.

find_encrypted_paths() in the same module has no callers outside itself.

Worth deciding deliberately, because widening the tuple changes what _normalize feeds the manifest hashes: on an Azure/GCP project holding such a value, the first run after the change would report a one-off "changed" state.

Suggested scope:

• add the GKMS / KV variants (and decide whether the ComponentSecure / ConfigSecure / ProjectWideSecure families need their cloud variants too),
• or replace the tuple with a shared helper so there is exactly one place in the codebase that knows the prefix family (services/data_app_service.py::ENCRYPTED_PASSWORD_PREFIXES is the other one, and it is deliberately project-scoped-only),
• note the one-off diff churn in the changelog entry.

Reference: https://developers.keboola.com/overview/encryption/