fix(security): protect credentials in deployment scripts

[carlosmmatos-cs]

Credentials handed to cURL now travel on its configuration input rather than as command-line arguments, across the four bash scripts and the three PowerShell scripts. That keeps them out of the process list and out of process-creation logs. Alongside that, every request and redirect is restricted to HTTPS, shell and PowerShell tracing is disabled before any credential is handled, secrets are dropped from the exported environment so child processes do not inherit them, and the downloaded installer is checked against a SHA-256 digest.

RHEL and CentOS 7 keep working. cURL 7.29.0 does not know the oauth2-bearer option, and rather than rejecting it, it ignores the key and sends the request with no credential at all — a silent failure. Each script now detects the capability and falls back to a raw Authorization header, still delivered on the configuration input. The version gate moves from 7.55 to 7.33, the release that added oauth2-bearer, so cURL 7.33 through 7.54 is no longer blocked for no reason, and the gate now exists in all four scripts instead of two. ALLOW_LEGACY_CURL and --allow-legacy-curl work as before, and their warning text now names the one thing that is genuinely unverified on very old cURL, which is redirect handling, plus the HTTPS restriction that bounds it. This is not a breaking change: anyone on EL7 already sets one of those flags to get past the old 7.55 gate.

Two smaller fixes fell out of this. aws_ssm_parameter printed its whole response body on failure, and since the request asks for decryption that body can carry the client secret, so it now reports the parameter name and the AWS error message instead. Separately, the command -v curl check sat inside a command substitution, where die only exits the subshell and leaves the result empty; in falcon-linux-uninstall.sh it also ran 39 lines before die was defined, so a host without cURL got die: command not found rather than the intended message.

On the CI side, the container compatibility matrix passed its setup command through a variable that the container shell expanded after parsing, so && and > arrived as literal arguments and all five legs errored out. A small script that detects the package manager replaces it, and Oracle Linux 7 and CentOS 7 legs are added — the oldest cURL exercised before this was 7.81, so nothing anywhere near the version gate was covered. The regression suite itself could not fail: it called rg, which is not installed on ubuntu-latest, so if rg ...; then fail; fi read exit 127 as "no match" and three of its checks quietly did nothing. It now uses grep behind a helper that inspects the exit status explicitly, so a missing or broken tool fails instead of passing, and its mode loop exercises both credential mechanisms rather than a variable nothing read.

Last, the release job swept the whole tree for *.sh and *.ps1, so the new test and CI helper scripts would have shipped as release assets and appeared in checksum.txt. It is now restricted to the directories holding shipped artifacts, which brings the asset list back to the same 8 scripts and 3 zips as before.