fix(vercel): use sensitive type for SENTRY_AUTH_TOKEN env var

[sentry-junior]

Summary

Changes the Vercel env var type for SENTRY_AUTH_TOKEN from encrypted to sensitive so the value becomes write-only in Vercel — it cannot be read back through the Vercel API or dashboard after creation.

The Vercel API supports four env var types: system, encrypted, plain, and sensitive. We were using encrypted for all env vars including the auth token. Using sensitive for the auth token reduces blast radius if a Vercel account is compromised.

This applies to new installs and project mapping re-configurations. Existing env vars will be updated to sensitive when project mappings are next saved (the integration's update_organization_config calls create_env_var which falls through to update_env_variable on ENV_ALREADY_EXISTS).

Changes

• src/sentry/integrations/vercel/integration.py: SENTRY_AUTH_TOKEN type encrypted → sensitive in VercelEnvVarMapBuilder.build()
• tests/sentry/integrations/vercel/test_integration.py: updated env_var_map fixtures and request body assertions in test_update_org_config and test_update_org_config_vars_exist

Refs #113391

[sentry]

Bug: Updating an existing Vercel environment variable's type to sensitive via a PATCH request is an unsupported API operation and will either fail or be silently ignored.
_{Severity: HIGH}

Suggested Fix

To correctly change the environment variable type to sensitive, the variable must be deleted and then recreated. Implement a delete-then-create logic for environment variables when a type change from encrypted to sensitive is detected, instead of using the current PATCH update method. This may require adding a method to delete environment variables in the VercelClient.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: src/sentry/integrations/vercel/integration.py#L185

Potential issue: The code attempts to update an existing Vercel environment variable's
type from `encrypted` to `sensitive` using a `PATCH` request. According to Vercel's API
documentation, this operation is unsupported. This will either cause the API to return
an error, which will raise a `ValidationError` and break the configuration update
process for existing integrations, or the API will silently ignore the type change. If
ignored, the environment variable will remain `encrypted`, defeating the security goal
of the change for existing installations.

_{Did we get this right? 👍 / 👎 to inform future reviews.}