Document that resource ID can't be made secret in the state file

[mikhailshilkov]

Problem description

As shown in https://github.com/pulumi/pulumi/issues/8946, a resource id cannot be made secret. In a sense, it's logical that additionalSecretOutputs: ['id'] doesn't work, as id is not an output. On the other hand, some resources assign a potentially-secret output value to resource ID, which is currently impossible to hide from plain text.

Affected product version(s)

Pulumi 3.x.

Suggestions for a fix

Consider documenting this behavior somewhere in the secrets docs.