This is v2 of my attempt to add async support to @sensitive_variables and @sensitive_post_parameters. The original version had trouble with nested async functions which obviously required it to be reverted. I've realized that for further work on asyncifying the auth stack (current PR, discussion) I'll need @sensitive_variables eventually.

The broad problem that this attempts to solve is that async functions do not have a proper f_back field in tracebacks. I think python/cpython#91048 is the relevant upstream python ticket but I'm not sure. Since we can't rely on f_back we have to find another way to store and recover information about which variables are sensitive. Fortunately, due to the way @sensitive_post_parameters works it is not affected by the limitations of f_back. That decorator stores its state in the request parameter to the view function so no need to walk the stack or other trickery.

To persist the sensitive variables list for async functions, we can use a global dict with the hash of the filename and line number of the function as the key (more formally: hash(f"{file_path}:{line_number}") and the value is the tuple or sensitive variables (or __ALL__). Then, during traceback cleanup we can read this dict by reconstructing the same key with f_code.co_filename and f_code.co_firstlineno to lookup the relevant value in the dict.

We could swap over sync functions to this new and improved way of doing things, but that felt like too drastic of a change to me. It wouldn't be too difficult to swap everything over.

I've also added some more test coverage compared to v1 of this PR, which should help alleviate any concerns that this version is stiill fragile. (happy to add more tests, I added what I hypothesized this solution might not work for, open to other ideas)