Redact the message field of transaction events

Events generated during resource application accept among other values an arbitrary message. The message is logged to indicate when resource properties change, and they include the previous value and the newly set value. This is problematic if the property is sensitive; even if the event itself knows that it is sensitive there's no good way of redacting the previous and desired values in that message.

We need to either change the interface of Puppet::Transaction::Event to be able to redact messages containing sensitive information, or change how those messages are set to ensure that callers provide the redaction themselves. For the former case we can change events to take a format string, the previous value, desired value, and associated property and have the event itself take care of the redaction. For the latter case, we might have to do something evil like override Puppet::Property#is_to_s and Puppet::Property#should_to_s to provide the redaction themselves; this will have to be done in a way that handles subclasses that already override those methods.