Limit the information from the support script introduced in #1287

[mattiaswal]

Description

For security reasons limit the information given in show running, remove private keys, passwords and hashes.

For example ignore all nodes in the schema defined as default deny;

Additional Information

No response

General Information

Anyone can help out by sponsoring development of new features or contributing pull requests.
Please use this issue for discussions related to the feature.

[troglobit]

What would be great here is if we could have an operator level user

Current state

• Only one group: admin with full permit-all access
• One specific deny rule for passwords (but admin can bypass it)
• The nacm:default-deny-all extensions in YANG models would work, but only if there's a non-admin user

What's needed

1. operator group - Can read most config (sensitive data filtered out), can make configuration changes, but perhaps restricted from:
   - Reading private keys, passwords, shared secrets (respects nacm:default-deny-all)
   - Factory reset operations
   - User management
   - NACM rule changes
2. guest (read-only/monitor) - Can only:
   - View operational state (interface status, routes, statistics)
   - Cannot read any configuration
   - Cannot make any changes

This would make the support collect command much safer when run by an operator user - sensitive data would be automatically filtered by sysrepo's NACM implementation without needing any custom filtering code.

The beauty of this approach is that it leverages the existing nacm:default-deny-all markings already present in the YANG models, making it maintainable and consistent with the NETCONF/YANG standards.