fix: wipe user secrets when user is soft-deleted (#24985)

Extend the delete_deleted_user_resources() trigger so that secrets
belonging to a soft-deleted user are removed in the same transaction as
the existing api_keys and user_links cleanup.

user_secrets.user_id has ON DELETE CASCADE, but Coder soft-deletes users
by flipping users.deleted rather than removing the row, so the foreign key
cascade never fires and secrets would otherwise survive deletion.

Assisted by Coder Agents.

enterprise/cli/server_dbcrypt_test.go

@@ -234,7 +234,7 @@ func genData(t *testing.T, db database.Store) []database.User {
 					OAuthAccessToken:  "access-" + usr.ID.String(),
 					OAuthRefreshToken: "refresh-" + usr.ID.String(),
 				})
-				// Deleted users cannot have user_links
+				// Deleted users cannot have user_links or user_secrets.
 				if !deleted {
 					// Fun fact: our schema allows _all_ login types to have
 					// a user_link. Even though I'm not sure how it could occur
@@ -245,15 +245,15 @@ func genData(t *testing.T, db database.Store) []database.User {
 						OAuthAccessToken:  "access-" + usr.ID.String(),
 						OAuthRefreshToken: "refresh-" + usr.ID.String(),
 					})
-				}
 
-				_ = dbgen.UserSecret(t, db, database.UserSecret{
-					UserID:   usr.ID,
-					Name:     "secret-" + usr.ID.String(),
-					Value:    "value-" + usr.ID.String(),
-					EnvName:  "",
-					FilePath: "",
-				})
+					_ = dbgen.UserSecret(t, db, database.UserSecret{
+						UserID:   usr.ID,
+						Name:     "secret-" + usr.ID.String(),
+						Value:    "value-" + usr.ID.String(),
+						EnvName:  "",
+						FilePath: "",
+					})
+				}
 				users = append(users, usr)
 			}
 		}