Document post-5.5 features: Deferred functions, securing sensitive data, Resource API

[miharp]

Summary

Our language docs were imported from Puppet 5.5 (3cad11c), so features introduced in Puppet 6–8 have no narrative documentation here at all.
Found while auditing the collection against the Puppet Core 8 language docs.

Deferred functions (entire feature undocumented)

The Deferred type and agent-side function evaluation (Puppet 6.0) — the standard mechanism for agent-side secrets retrieval — is completely absent.
Upstream covers it in five topics:

• Deferred functions overview (Deferred type, agent-side evaluation, constraints such as built-in-types-only arguments)
• Deferring a function (how-to)
• Using templates with Deferred values (deferring the render, not the template)
• Tutorial: writing a deferred function for secrets retrieval
• Secret-store integration overview

These could land as one or two pages rather than mirroring upstream's five-way split.

Securing sensitive data

• Practices guide around Sensitive (we only have the type page lang_data_sensitive): using Sensitive in resources and templates, interaction with Deferred, what does and doesn't end up in catalogs/reports/logs

Resource API

• We only document the legacy types-and-providers method (custom_types, provider_development); upstream now frames the Resource API as the primary way to write resource types.
  Needs a placement decision first: openvox collection vs ecosystem docs.

Notes for implementation

• Licensing: help.puppet.com content is Perforce copyright — structural/coverage reference only, do not copy. Write original prose; verify behavior against OpenVox 8.
• New pages need nav entries in _data/nav/openvox_8x.yml.
• Related: missing data-type pages are tracked in Document the data types missing from the language reference #407 and the 5.5-staleness sweep in Refresh 5.5-era language docs: terminology, version references, facts #409.