Suppress RHSM credential exposure in build logs

Remove -x (xtrace) from the global set flags and explicitly suppress
xtrace around the subscription-manager register call to prevent
plaintext RHSM_PASSWORD from being expanded to stderr and captured in
the build log. Quote all variable expansions to prevent word splitting.

Jira: OSPRH-32782

Author: steveb

bootc/rhsm.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-set -eux
+set -eu
 
 # Edit RHSM_ values for the subscription configuration
 RHSM_USER=unset
@@ -13,8 +13,11 @@ RHSM_REPOS=${RHSM_REPOS:-"--enable=rhoso-18.0-for-rhel-${RHEL_MAJOR}-x86_64-rpms
 RHSM_POOL=""
 
 rm -f /etc/yum.repos.d/*.repo
-subscription-manager register --username=$RHSM_USER --password=$RHSM_PASSWORD
+# Suppress xtrace to avoid leaking credentials to the build log
+set +x
+subscription-manager register --username="$RHSM_USER" --password="$RHSM_PASSWORD"
+set -x
 if [ -n "${RHSM_POOL}" ]; then
-    subscription-manager attach --pool=$RHSM_POOL
+    subscription-manager attach --pool="$RHSM_POOL"
 fi
 subscription-manager repos $RHSM_REPOS