Log environment variables sorted by key while redacting values of unsafe ones

[ssbarnea]

Improves logging of environment variables by sorting them by key and redacting the values for the ones that are likely to contain secrets.

Fixes: #3542

• ran the linter to address style issues (tox -e fix)
• wrote descriptive pull request text
• ensured there are test(s) validating the fix
• added news fragment in docs/changelog folder
• updated/extended the documentation

[ssbarnea]

@gaborbernat Any chance you could look at it again today? I think that I addressed the requests.

This patch is a blocker for improving the security of GHA pipelines as I would not want to disable log collection for tox. Thanks.

Please review again, I made the required changes, dropped the notice, added documentation entry, tested all keywords.

[ssbarnea]

@gaborbernat Sorry to bother you again. Is there anything else I need to change?

[gaborbernat]

[ssbarnea]

@gaborbernat The py314 failure is unrelated and seems to be a bug in coveragepy. I will try to help @nedbat with a patch if I do not run out of time. That also made me realize that I need to fix few bugs in tox-uv in order to run coveragepy tests..., side effect raising tox-dev/tox-uv#210

[ssbarnea]

@gaborbernat Any idea about what to do about py314 errors related to coverage?

CoverageWarning: Couldn't import C tracer: No module named 'coverage.tracer' (no-ctracer)

They started to fail on main last night, so unrelated to this patch. Should we attempt to capture/hide these warnings to avoid our test failures?

[nedbat]

I think I will skip that warning on platforms where I don't ship a built wheel, though I'd be curious whether the installation of coverage on 3.14 shows that it tried to compile the extension or not?

[nedbat]

Coverage 7.9.1 is released to quiet that warning on 3.14.