bug: masked variables will trigger a diff every time

[studerma]

code:

    - name: "Save the Account key to Secret Server"
      secretserver:
        secretserver_password: "{{ secserv_password }}"
        secretserver_username: "{{ secserv_username }}"
        secretserver_base_url: "{{ secretserver_base_url }}"
        action: "upsert"
        type: "x509"
        folder_id: "{{ secretserver_folder_id }}"
        secret_name: "lets_encrypt::{{ deploy_env }}::account_key"
        private_key: "{{ le_account_key.content }}"
      delegate_to: "localhost"

the insertion runs as expected, but it shows up as changed every time

TASK [cms/nginx : Save the Account key to Secret Server] ***********************************************************************************************************************************************************************************************
--- before
+++ after
@@ -4,8 +4,8 @@
     "Location": "",
     "Notes": "",
     "PKCS12": "*** Not Valid For Display ***",
-    "Password": "***MASKED_FOR_PRIVACY***",
-    "Private key": "***MASKED_FOR_PRIVACY***",
+    "Password": "",
+    "Private key": "*** Not Valid For Display ***",
     "SubjAltName": "",
     "folder_id": 2130,
     "secret_id": 11745


changed: [idcmsintproxy01.id-sys.unibe.ch -> localhost] => {
    "changed": true,
    "data": {
        "secret_id": 11745
    },
    "diff": {
        "after": {
            "CN": "",
            "Certificate": "*** Not Valid For Display ***",
            "Location": "",
            "Notes": "",
            "PKCS12": "*** Not Valid For Display ***",
            "Password": "",
            "Private key": "*** Not Valid For Display ***",
            "SubjAltName": "",
            "folder_id": 2130,
            "secret_id": 11745
        },
        "before": {
            "CN": "",
            "Certificate": "*** Not Valid For Display ***",
            "Location": "",
            "Notes": "",
            "PKCS12": "*** Not Valid For Display ***",
            "Password": "***MASKED_FOR_PRIVACY***",
            "Private key": "***MASKED_FOR_PRIVACY***",
            "SubjAltName": "",
            "folder_id": 2130,
            "secret_id": 11745
        }
    },
    "invocation": {
        "module_args": {
            "action": "upsert",
            "alt_name": null,
            "certificate": null,
            "common_name": null,
            "connection_string": null,
            "database": null,
            "folder_id": 2130,
            "fqdn": null,
            "location": null,
            "logon_domain": null,
            "notes": null,
            "password": null,
            "private_key": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "search_text": null,
            "secret_id": null,
            "secret_name": "lets_encrypt::int::account_key",
            "secretserver_base_url": "https://idsecret.unibe.ch/SecretServer/",
            "secretserver_password": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "secretserver_token": null,
            "secretserver_username": "sysAnsibleRW",
            "type": "x509",
            "url": null,
            "user_name": null
        }
    }
}

this is a simple issue of what gets counted as equal in

ansible-module-secretserver/library/secretserver.py

Line 972 in e31d422

"changed": previous_password != updated_password,

so this should not be a huge issue.