feat: audit user secret create, update, and delete (#24756)

Emit user secret audit log entries for create/update/delete operations.
Reads stay un-audited, matching every other resource.

Audit log entries record changes in user secret name, environment
variable name, file path, and value. The secret value column is marked
`ActionSecret` so the diff records the change without showing the
ciphertext or plaintext.

Closes a TOCTOU window on delete to ensure no phantom audit logs for a
delete of a non-existent secret. Secret update accepts a small TOCTOU
window matching the other audited resources (templates, workspaces,
chats). The two-query pattern is wrapped in a transaction so audit state
can't leak from a failed mutation.

codersdk/audit.go

@@ -47,6 +47,7 @@ const (
 	ResourceTypeTask         ResourceType = "task"
 	ResourceTypeAISeat       ResourceType = "ai_seat"
 	ResourceTypeChat         ResourceType = "chat"
+	ResourceTypeUserSecret   ResourceType = "user_secret"
 )
 
 func (r ResourceType) FriendlyString() string {
@@ -109,6 +110,8 @@ func (r ResourceType) FriendlyString() string {
 		return "ai seat"
 	case ResourceTypeChat:
 		return "chat"
+	case ResourceTypeUserSecret:
+		return "user secret"
 	default:
 		return "unknown"
 	}