Reject validator changes to secret classification

validation.go

@@ -112,6 +112,18 @@ func runValidation[T any](configuration *T, validator func(*T, *Validation), sch
 	for _, delta := range compareDocumentTrees(before, after) {
 		state.diagnostics = append(state.diagnostics, validationMutationDiagnostic(delta.path))
 	}
+	beforeSensitivity := projectedSensitivity(before)
+	afterSensitivity := projectedSensitivity(after)
+	for pointer, path := range beforeSensitivity {
+		if _, exists := afterSensitivity[pointer]; !exists {
+			state.diagnostics = append(state.diagnostics, validationMutationDiagnostic(path))
+		}
+	}
+	for pointer, path := range afterSensitivity {
+		if _, exists := beforeSensitivity[pointer]; !exists {
+			state.diagnostics = append(state.diagnostics, validationMutationDiagnostic(path))
+		}
+	}
 	for _, path := range changedSecretStates(reflect.ValueOf(*configuration), schema.root, lookups) {
 		state.diagnostics = append(state.diagnostics, validationMutationDiagnostic(path))
 	}