[BUG]: `plaintext_value` → `value` rename emits spurious update diff on every existing *OrganizationSecret

Start at the schemas for github_actions_organization_secret and github_dependabot_organization_secret, focusing on the deprecated plaintext_value and encrypted_value entries. Compare the etag diff-suppression pattern from #2840 and reproduce the rename with terraform plan or pulumi preview. Done means renaming the arguments no longer shows a diff or triggers an unnecessary secret update when the value is unchanged.

Module

github_actions_organization_secret, github_dependabot_organization_secret

Version

v6.12.0 (introduced by #3225)

What happened

PR #3225 renamed plaintext_value → value (and encrypted_value → value_encrypted) on the secret resources and deprecated the old property names, but did not add a DiffSuppressFunc to smooth the migration. As a result, every existing resource that was created with plaintext_value in state now shows an ~ update diff after the user renames the argument in their config — even though the secret's actual value is unchanged.

For our Pulumi wrapper (pulumi-github, bridged from this provider), we see 174 ~ update [diff: +value-plaintextValue] entries across 11 stacks, one per *OrganizationSecret resource, after switching the single source-code call site from plaintext_value=... to value=.... Each update issues a GitHub API call that writes the same plaintext secret value back. Idempotent on the GitHub side, but noisy:

• 174 unnecessary writes to sensitive resources.
• 174 audit-log entries that look like real secret changes.
• State-side churn on what should be a pure property rename.

What was expected

A DiffSuppressFunc on the deprecated plaintext_value (and encrypted_value) properties so that when the new value (or value_encrypted) contains the same data, no diff is shown — mirroring the pattern already established for etag properties in #2840.

Reproduction

1. Create a github_actions_organization_secret (or github_dependabot_organization_secret) with plaintext_value = "foo" under provider v6.11.x.
2. Upgrade to v6.12.0+.
3. Rename the argument to value = "foo" (no value change).
4. Run terraform plan (or pulumi preview) — observe an update entry with a diff of the form +value-plaintextValue (or +value-plaintext_value in TF syntax).

Suggested fix

Add DiffSuppressFunc to the deprecated plaintext_value / encrypted_value schema entries so they diff-suppress against their replacements when the underlying value is unchanged. The etag handling in #2840 is a good template.

Happy to open a PR if that helps — flag if you'd accept one.