Implement finalized test suite for the CLI and configuration code

internal/cli/state_hardening_test.go

@@ -256,7 +256,7 @@ func TestRunRedactsSensitiveModuleOptionsFromConfigAndPipelineSummaries(t *testi
 	if err != nil {
 		t.Fatal(err)
 	}
-	configText := strings.Replace(string(data), "    input: test/input\n", `    input:
+	configText := replaceRequiredOnce(t, string(data), "    input: test/input\n", `    input:
       module: test/input
       options:
         api_key: CONFIG_SUMMARY_SECRET_SENTINEL
@@ -264,7 +264,7 @@ func TestRunRedactsSensitiveModuleOptionsFromConfigAndPipelineSummaries(t *testi
         nested:
           - - password: PIPELINE_SUMMARY_SECRET_SENTINEL
               neighbor: SAFE_NESTED_OPTION_SENTINEL
-`, 1)
+`)
 	if err := os.WriteFile(roots.config, []byte(configText), 0o600); err != nil {
 		t.Fatal(err)
 	}