feat: add enable/disable support for user secrets (#27537)

Users can now disable a secret to stop it from being injected into
workspaces without deleting it, and re-enable it later. Disabled secrets
stay visible and editable everywhere they already appear.

An enabled secret must have at least one injection target; a secret with
no target can be stored only while disabled. Existing target-less secrets
are migrated to disabled to preserve current behavior.

Support spans the REST API, SDK, CLI, dashboard, and audit log.

coderd/usersecretsimport_test.go

@@ -179,8 +179,9 @@ func TestImportUserSecretsConflict(t *testing.T) {
 	ctx := testutil.Context(t, testutil.WaitMedium)
 
 	_, err := client.CreateUserSecret(ctx, codersdk.Me, codersdk.CreateUserSecretRequest{
-		Name:  "EXISTING",
-		Value: "original",
+		Name:    "EXISTING",
+		Value:   "original",
+		EnvName: "EXISTING",
 	})
 	require.NoError(t, err)
 	auditor.ResetLogs()
@@ -217,8 +218,9 @@ func TestImportUserSecretsLimits(t *testing.T) {
 
 		for i := 0; i < codersdk.MaxUserSecretsPerUserCount-1; i++ {
 			_, err := client.CreateUserSecret(ctx, codersdk.Me, codersdk.CreateUserSecretRequest{
-				Name:  fmt.Sprintf("prefill-%03d", i),
-				Value: "original",
+				Name:     fmt.Sprintf("prefill-%03d", i),
+				Value:    "original",
+				FilePath: fmt.Sprintf("/tmp/prefill-%03d", i),
 			})
 			require.NoError(t, err)
 		}