feat: audit user secret create, update, and delete (#24756)

Emit user secret audit log entries for create/update/delete operations.
Reads stay un-audited, matching every other resource.

Audit log entries record changes in user secret name, environment
variable name, file path, and value. The secret value column is marked
`ActionSecret` so the diff records the change without showing the
ciphertext or plaintext.

Closes a TOCTOU window on delete to ensure no phantom audit logs for a
delete of a non-existent secret. Secret update accepts a small TOCTOU
window matching the other audited resources (templates, workspaces,
chats). The two-query pattern is wrapped in a transaction so audit state
can't leak from a failed mutation.

coderd/database/queries/user_secrets.sql

@@ -3,6 +3,11 @@ SELECT *
 FROM user_secrets
 WHERE user_id = @user_id AND name = @name;
 
+-- name: GetUserSecretByID :one
+SELECT *
+FROM user_secrets
+WHERE id = @id;
+
 -- name: ListUserSecrets :many
 -- Returns metadata only (no value or value_key_id) for the
 -- REST API list and get endpoints.
@@ -56,6 +61,7 @@ SET
 WHERE user_id = @user_id AND name = @name
 RETURNING *;
 
--- name: DeleteUserSecretByUserIDAndName :execrows
+-- name: DeleteUserSecretByUserIDAndName :one
 DELETE FROM user_secrets
-WHERE user_id = @user_id AND name = @name;
+WHERE user_id = @user_id AND name = @name
+RETURNING *;