feat: audit user secret create, update, and delete (#24756)

Emit user secret audit log entries for create/update/delete operations.
Reads stay un-audited, matching every other resource.

Audit log entries record changes in user secret name, environment
variable name, file path, and value. The secret value column is marked
`ActionSecret` so the diff records the change without showing the
ciphertext or plaintext.

Closes a TOCTOU window on delete to ensure no phantom audit logs for a
delete of a non-existent secret. Secret update accepts a small TOCTOU
window matching the other audited resources (templates, workspaces,
chats). The two-query pattern is wrapped in a transaction so audit state
can't leak from a failed mutation.

coderd/apidoc/docs.go

@@ -19777,7 +19777,8 @@ const docTemplate = `{
                 "workspace_app",
                 "task",
                 "ai_seat",
-                "chat"
+                "chat",
+                "user_secret"
             ],
             "x-enum-varnames": [
                 "ResourceTypeTemplate",
@@ -19807,7 +19808,8 @@ const docTemplate = `{
                 "ResourceTypeWorkspaceApp",
                 "ResourceTypeTask",
                 "ResourceTypeAISeat",
-                "ResourceTypeChat"
+                "ResourceTypeChat",
+                "ResourceTypeUserSecret"
             ]
         },
         "codersdk.Response": {