chore: remove coder_secret Terraform integration (#25512)

Removes the coder_secret Terraform integration: the data.coder_secret
consumption path through provisionerdserver → provisioner.proto →
provisioner/terraform, the dynamic-parameter secret-requirement
validation, and the workspace-update / resolve-autostart surfaces that
depended on it. This is being done due to a product/feature direction
change (see PLAT-243). User-secret CRUD (DB, REST, CLI, UI, telemetry, audit)
and the agent-manifest secret-injection path are untouched.

The provisionerd API is bumped from v1.17 to v1.18 rather than rolled
back: v1.17 shipped in v2.33.x, so user_secrets field numbers are
reserved and the changelog documents both versions.

Generated with assistance from Coder Agents.

coderd/workspaces.go

@@ -25,7 +25,6 @@ import (
 	"github.com/coder/coder/v2/coderd/database/dbauthz"
 	"github.com/coder/coder/v2/coderd/database/dbtime"
 	"github.com/coder/coder/v2/coderd/database/provisionerjobs"
-	"github.com/coder/coder/v2/coderd/dynamicparameters"
 	"github.com/coder/coder/v2/coderd/httpapi"
 	"github.com/coder/coder/v2/coderd/httpapi/httperror"
 	"github.com/coder/coder/v2/coderd/httpmw"
@@ -795,7 +794,6 @@ func createWorkspace(
 			Experiments(api.Experiments).
 			DeploymentValues(api.DeploymentValues).
 			RichParameterValues(req.RichParameterValues).
-			Logger(api.Logger.Named("wsbuilder")).
 			BuildMetrics(api.WorkspaceBuilderMetrics)
 		if req.TemplateVersionID != uuid.Nil {
 			builder = builder.VersionID(req.TemplateVersionID)
@@ -2010,36 +2008,6 @@ func (api *API) resolveAutostart(rw http.ResponseWriter, r *http.Request) {
 			break
 		}
 	}
-
-	// Surface whether the active template version declares coder_secret
-	// requirements that the workspace owner's secrets do not satisfy. The
-	// intention is for this information to inform the workspace update
-	// requirement so the user knows autostart will not run an auto-update
-	// build until the missing secrets are satisfied.
-	//
-	// Callers without user_secret:read on the workspace owner produce a
-	// forbidden warning diagnostic. This is treated as "unknown" and
-	// no mismatch is reported rather than returning a partial answer.
-	secretMismatch, err := dynamicparameters.EvaluateSecretMismatch(
-		ctx,
-		api.Logger.Named("dynamicparameters"),
-		api.Database, api.FileCache, version, workspace.OwnerID, dbBuildParams,
-	)
-	switch {
-	case err == nil:
-		response.SecretMismatch = secretMismatch
-	case xerrors.Is(err, dynamicparameters.ErrTemplateVersionNotReady):
-		// Active version's provisioner job hasn't completed yet. Leave
-		// SecretMismatch false.
-	default:
-		// Don't drop the already-computed ParameterMismatch signal on a
-		// renderer infrastructure error. Log and treat as "unknown."
-		api.Logger.Warn(ctx, "failed to evaluate secret requirements",
-			slog.F("workspace_id", workspace.ID),
-			slog.Error(err),
-		)
-	}
-
 	httpapi.Write(ctx, rw, http.StatusOK, response)
 }