[client] Address review: redact and clear the MDM upload URL

- Never log the MDM-provided upload URL (it can embed credentials or
  signed query tokens): mark the key secret so it is redacted, and drop
  the raw value from the invalid-URL warning.
- Clear DebugBundleUploadURL when a replacement policy no longer carries
  the key, so a removed override can never keep directing uploads to a
  previously-enforced host; covered by a policy-replacement test.
- macOS docs: state "https URL with a host" consistently, and make the
  managed-plist helper fail closed on an invalid allowRemoteJobs value
  (emit false rather than dropping the key).

client/internal/profilemanager/config.go

@@ -770,13 +770,18 @@ func (config *Config) applyMDMPolicy(policy *mdm.Policy) {
 	if v, ok := policy.GetString(mdm.KeyBundleUploadURL); ok {
 		// Must be a well-formed https URL with a host, matching the client's
 		// remote-job upload-URL validation. Invalid values are skipped so a
-		// bad policy cannot break bundle uploads.
+		// bad policy cannot break bundle uploads. The URL is not logged: it
+		// can embed credentials or signed query tokens.
 		if u, err := url.Parse(v); err != nil || u.Scheme != "https" || u.Host == "" {
-			log.Warnf("MDM debug bundle upload URL %q invalid (must be an https URL with a host); keeping previous value", v)
+			log.Warnf("MDM debug bundle upload URL is invalid (must be an https URL with a host); keeping previous value")
 		} else {
 			config.DebugBundleUploadURL = v
-			logApplied(mdm.KeyBundleUploadURL, v)
+			logApplied(mdm.KeyBundleUploadURL, "")
 		}
+	} else {
+		// The key was dropped from the policy: clear any stale override so it
+		// can never keep directing uploads to a previously-enforced host.
+		config.DebugBundleUploadURL = ""
 	}
 }
 

client/internal/profilemanager/config_test.go

@@ -324,6 +324,14 @@ func TestApplyMDMPolicyRemoteJobs(t *testing.T) {
 		}))
 		assert.Empty(t, cfg.DebugBundleUploadURL, "a non-https upload URL must be skipped")
 	})
+
+	t.Run("dropping the key clears a previously-applied override", func(t *testing.T) {
+		cfg := &Config{DebugBundleUploadURL: "https://old.example.com"}
+		// A replacement policy that no longer carries the key must not leave
+		// the old upload target directing bundles.
+		cfg.applyMDMPolicy(mdm.NewPolicy(map[string]any{mdm.KeyRemoteJobsAllowed: true}))
+		assert.Empty(t, cfg.DebugBundleUploadURL, "the stale upload URL override must be cleared")
+	})
 }
 
 func TestUpdateOldManagementURL(t *testing.T) {

client/mdm/policy.go

@@ -82,6 +82,8 @@ const (
 // SecretKeys lists keys whose values must be redacted in logs.
 var SecretKeys = map[string]struct{}{
 	KeyPreSharedKey: {},
+	// The upload URL can embed credentials or signed query tokens.
+	KeyBundleUploadURL: {},
 }
 
 // boolStringLiterals enumerates the textual boolean encodings the