feat: add enable/disable support for user secrets (#27537)

Users can now disable a secret to stop it from being injected into
workspaces without deleting it, and re-enable it later. Disabled secrets
stay visible and editable everywhere they already appear.

An enabled secret must have at least one injection target; a secret with
no target can be stored only while disabled. Existing target-less secrets
are migrated to disabled to preserve current behavior.

Support spans the REST API, SDK, CLI, dashboard, and audit log.

enterprise/coderd/usersecrets_audit_test.go

@@ -58,6 +58,7 @@ func TestUserSecretAuditDiffRedaction(t *testing.T) {
 		Name:        "createDiff-target",
 		Description: initialDescription,
 		Value:       initialValue,
+		EnvName:     "CREATE_DIFF_TARGET",
 	})
 	require.NoError(t, err)