feat: add enable/disable support for user secrets (#27537)

Users can now disable a secret to stop it from being injected into
workspaces without deleting it, and re-enable it later. Disabled secrets
stay visible and editable everywhere they already appear.

An enabled secret must have at least one injection target; a secret with
no target can be stored only while disabled. Existing target-less secrets
are migrated to disabled to preserve current behavior.

Support spans the REST API, SDK, CLI, dashboard, and audit log.

cli/testdata/coder_secret_create_--help.golden

@@ -12,6 +12,11 @@ OPTIONS:
       --description string
           Set the secret description.
 
+      --enabled bool (default: true)
+          Whether the secret is injected into workspaces. An enabled secret must
+          set --env or --file; pass --enabled=false to store a secret without
+          injecting it.
+
       --env string
           Name of the workspace environment variable that this secret will set.