chore: remove coder_secret Terraform integration (#25512)

Removes the coder_secret Terraform integration: the data.coder_secret
consumption path through provisionerdserver → provisioner.proto →
provisioner/terraform, the dynamic-parameter secret-requirement
validation, and the workspace-update / resolve-autostart surfaces that
depended on it. This is being done due to a product/feature direction
change (see PLAT-243). User-secret CRUD (DB, REST, CLI, UI, telemetry, audit)
and the agent-manifest secret-injection path are untouched.

The provisionerd API is bumped from v1.17 to v1.18 rather than rolled
back: v1.17 shipped in v2.33.x, so user_secrets field numbers are
reserved and the changelog documents both versions.

Generated with assistance from Coder Agents.

coderd/provisionerdserver/provisionerdserver.go

@@ -591,26 +591,6 @@ func (s *server) acquireProtoJob(ctx context.Context, job database.ProvisionerJo
 			}
 		}
 
-		// Fetch user secrets for build-time injection, but only on start
-		// transitions where the workspace actually needs them.
-		var userSecrets []*sdkproto.UserSecretValue
-		if workspaceBuild.Transition == database.WorkspaceTransitionStart {
-			dbSecrets, err := s.Database.ListUserSecretsWithValues(ctx, owner.ID)
-			if err != nil {
-				return nil, failJob(fmt.Sprintf("get user secrets: %s", err))
-			}
-			for _, secret := range dbSecrets {
-				if secret.EnvName == "" && secret.FilePath == "" {
-					continue
-				}
-				userSecrets = append(userSecrets, &sdkproto.UserSecretValue{
-					EnvName:  secret.EnvName,
-					FilePath: secret.FilePath,
-					Value:    []byte(secret.Value),
-				})
-			}
-		}
-
 		transition, err := convertWorkspaceTransition(workspaceBuild.Transition)
 		if err != nil {
 			return nil, failJob(fmt.Sprintf("convert workspace transition: %s", err))
@@ -793,8 +773,7 @@ func (s *server) acquireProtoJob(ctx context.Context, job database.ProvisionerJo
 					TaskPrompt:                    task.Prompt,
 					TemplateVersionModulesFile:    versionModulesFile,
 				},
-				LogLevel:    input.LogLevel,
-				UserSecrets: userSecrets,
+				LogLevel: input.LogLevel,
 			},
 		}
 	case database.ProvisionerJobTypeTemplateVersionDryRun: