UI: submit object storage creation using POST

[Dogface2k]

Description

This PR fixes object storage creation from the UI by submitting addObjectStoragePool as a form-encoded POST request instead of a GET request.

The object-storage form carries provider access and secret keys in indexed details parameters. Sending those parameters with GET both fails when POST enforcement is enabled and places credentials in the request URL. The UI now uses the existing postAPI transport, preserving the command and parameter names while moving them into the request body.

Credential handling is hardened across this request's failure and diagnostic paths as part of the same fix:

• addObjectStoragePool is classified as carrying sensitive request information;
• management-server START/END logging keeps the client, HTTP method and command but excludes request parameters for this command, whether they arrived through POST or a legacy query string;
• browser error diagnostics remain enabled and retain error name/code, integer HTTP status, method and CloudStack command, without serializing Axios request bodies, query parameters, response bodies or unexpected nested objects;
• the secret-key field uses a password input with autocomplete disabled.

Ordinary non-sensitive API request logging is unchanged. Requests containing user data continue to receive the same parameter suppression. Object-store discovery, provider behavior, persistence, responses and authorization are unchanged.

Fixes #13679

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)
• Build/CI
• Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

• Major
• Minor

Bug Severity

• BLOCKER
• Critical
• Major
• Minor
• Trivial

Screenshots (if appropriate):

Not applicable.

How Has This Been Tested?

Regression coverage exercises the request transport and each changed diagnostic boundary:

• the UI component test verifies one POST to /, no query-parameter payload, preservation of indexed access-key and secret-key fields (including URL-sensitive characters) in the form body, failure propagation, and password masking;
• browser logging tests pass synthetic access, secret and session keys through POST and GET Axios error objects and verify that only safe scalar diagnostic metadata reaches console.error;
• servlet tests verify parameter suppression for object-storage requests sent as POST or legacy query strings, user-data suppression, and ordinary-command controls;
• the API command test verifies that the request is classified as containing sensitive information.

The patch passes git diff --check. It was tested locally with Temurin Java 17 and Node 16.20.2.

API module:
Tests run: 715, Failures: 0, Errors: 0, Skipped: 0
Checkstyle violations: 0

Server module:
Tests run: 2920, Failures: 0, Errors: 0, Skipped: 9
Checkstyle violations: 0

Focused ApiServletTest:
Tests run: 28, Failures: 0, Errors: 0, Skipped: 0

UI production build:
Build complete. The dist directory is ready to be deployed.

UI lint:
No lint errors found

Full UI unit suite:
Test Suites: 6 passed, 6 total
Tests: 182 passed, 182 total

How did you try to break this feature and the system with this change?

The transport test uses the real indexed credential parameter names, includes +, & and = in the secret, and asserts that Axios receives no params object, preventing fallback to a URL query string. A rejected request verifies that backend failures are still propagated.

Synthetic credential sentinels were placed in Axios POST bodies, GET parameters and response bodies; none appear in the emitted browser diagnostic. Nested object values were also supplied in fields intended for scalar diagnostics and were dropped rather than serialized. The management-server controls cover a sensitive legacy query string, a user-data request, and ordinary POST/query requests. Sensitive object-storage requests retain correlation metadata without their parameters; ordinary commands retain their normal diagnostics.