fix(transformations): match nested opaque field hints so sub-resource secrets are hashed at rest