[eavanvalkenburg]

Motivation & Context

Make settings-value behavior more consistent across Python formatting and provider integrations.

Description & Review Guide

• What are the major changes? Refine SecretString behavior and align provider credential handling and type annotations.
• What is the impact of these changes? SecretString is now a value wrapper rather than a str subclass. Callers needing a plain string should use get_secret_value(). Plain-string settings inputs remain supported.
• What do you want reviewers to focus on? Consistent settings behavior and compatibility at provider boundaries.

Related Issue

N/A.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.