pub(crate) fn format_denial_reason( reason: &SecretDenialReason, key: &str, profile: &TrustProfileName, ) -> String