feat(rds): add urlSafePassword option to DatabaseSecret for URL parser compatibility

[pahud]

Issue # (if applicable)

Closes #35175.

Reason for this change

Go applications using net/url parser fail when parsing database connection URLs containing RDS-generated passwords with caret (^) characters. The error net/url: invalid userinfo prevents Go developers from using CDK-generated RDS passwords in connection URLs, forcing them to manually generate passwords or work around the issue.

This change adds an optional urlSafePassword property to DatabaseSecret and related credential interfaces, allowing developers to generate passwords that are compatible with URL parsers by excluding characters that cause parsing issues.

Description of changes

This implementation adds URL-safe password generation capability to the AWS RDS module:

• New urlSafePassword property: Added optional boolean property to DatabaseSecretProps, CredentialsBaseOptions, CredentialsFromUsernameOptions, SnapshotCredentialsFromGeneratedPasswordOptions, Credentials, and SnapshotCredentials interfaces
• URL-safe character exclusion: Created URL_SAFE_PASSWORD_EXCLUDE_CHARS constant that extends the default exclusion set with the caret (^) character
• Conditional exclusion logic: Enhanced DatabaseSecret constructor and SnapshotCredentials.fromGeneratedSecret() method to use URL-safe exclusions when urlSafePassword: true
• Precedence rules: Explicit excludeCharacters parameter takes precedence over urlSafePassword option for maximum user control
• Hash integration: Included urlSafePassword in logical ID hash calculation for proper secret replacement when replaceOnPasswordCriteriaChanges: true
• Comprehensive integration: Extended renderCredentials() and renderSnapshotCredentials() functions to propagate the option through all credential creation paths
• Full snapshot support: Fixed SnapshotCredentials.fromGeneratedSecret() to properly handle urlSafePassword option by implementing the same exclusion logic as DatabaseSecret

Design decisions made:

• Follows the established pattern from issue Make ExcludeCharacters configurable for aws-rds masterSecret #7911 (configurable exclusions) for consistency
• Purely additive optional feature to maintain complete backward compatibility
• Explicit parameter precedence (excludeCharacters overrides urlSafePassword) for predictable behavior
• Minimal character set extension (only adds ^) to maintain password entropy while solving the specific URL parsing issue
• Consistent implementation across both DatabaseSecret and SnapshotCredentials for unified behavior

Alternatives considered and rejected:

• Changing default exclusion behavior: Rejected due to breaking change implications
• Adding multiple URL-safe options: Rejected for API simplicity, single boolean covers the primary use case
• Excluding additional URL-problematic characters: Rejected to minimize impact on password entropy

Describe any new or updated permissions being added

N/A - This change only affects password generation character exclusions and does not require any new IAM permissions or resource access patterns.

Description of how you validated changes

Unit tests: Added 7 comprehensive unit tests covering all functionality:

• Basic URL-safe password functionality with CloudFormation template validation for DatabaseSecret
• Caret character exclusion verification in generated ExcludeCharacters property
• Precedence rules testing (explicit excludeCharacters overrides urlSafePassword)
• Logical ID changes with replaceOnPasswordCriteriaChanges integration
• Master secret integration scenarios
• NEW: SnapshotCredentials.fromGeneratedSecret() with urlSafePassword for database instances from snapshots
• NEW: SnapshotCredentials.fromGeneratedSecret() with urlSafePassword for database clusters from snapshots

Integration tests: Verified existing integration tests continue to pass. No new integration tests required as the feature follows established patterns and existing tests validate the password generation pipeline.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Features must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

✅ A exemption request has been requested. Please wait for a maintainer's review.

[pahud]

Exemption Request

Integration tests: Verified existing integration tests continue to pass. No new integration tests required as the feature follows established patterns and existing tests validate the password generation pipeline.