How to register secrets - as plugin developers, and users?

I don’t think there is a generic way to handle this for all cases, but I think that a (small) set of more generic filters could cover most cases.

A filter which accepts input (that it returns unchanged, unless some eat=true parameter is passed) and a sequence of inclusion/exclusion JSON query paths (as used by community.general.json_query) / jq expressions (used in other contexts) / something similar to select secret values (or reject non-secret values), would likely already cover a lot of cases.

Being able to define schemas for this (maybe stored as ansible vars, or also in other ways?) and reusing them in multiple places would likely also be useful, if you need to process similar lookup/query results in different places.