feat: audit user secret create, update, and delete (#24756)

Emit user secret audit log entries for create/update/delete operations.
Reads stay un-audited, matching every other resource.

Audit log entries record changes in user secret name, environment
variable name, file path, and value. The secret value column is marked
`ActionSecret` so the diff records the change without showing the
ciphertext or plaintext.

Closes a TOCTOU window on delete to ensure no phantom audit logs for a
delete of a non-existent secret. Secret update accepts a small TOCTOU
window matching the other audited resources (templates, workspaces,
chats). The two-query pattern is wrapped in a transaction so audit state
can't leak from a failed mutation.

coderd/audit/diff.go

@@ -34,7 +34,8 @@ type Auditable interface {
 		idpsync.RoleSyncSettings |
 		database.TaskTable |
 		database.AiSeatState |
-		database.Chat
+		database.Chat |
+		database.UserSecret
 }
 
 // Map is a map of changed fields in an audited resource. It maps field names to