feat: surface missing coder_secret requirements on resolve-autostart (#25081)

Adds `dynamicparameters.EvaluateSecretMismatch` as a shared helper on
top of the existing renderer, then wires it into the resolve-autostart
handler so the UI can surface unsatisfied `coder_secret` requirements in
a template alongside parameter mismatch for autostart.

The lifecycle executor changes will land in a follow-up that depend
on this helper. The UI changes that consume the new `secret_mismatch`
field is also a follow-up.

Generated with assistance from Coder Agents.

coderd/apidoc/docs.go

@@ -21557,6 +21557,10 @@ const docTemplate = `{
             "properties": {
                 "parameter_mismatch": {
                     "type": "boolean"
+                },
+                "secret_mismatch": {
+                    "description": "SecretMismatch is true when the active template version declares\n` + "`" + `coder_secret` + "`" + ` requirements that the workspace owner's secrets do not\nsatisfy.",
+                    "type": "boolean"
                 }
             }
         },

coderd/apidoc/swagger.json

@@ -19775,6 +19775,10 @@
 			"properties": {
 				"parameter_mismatch": {
 					"type": "boolean"
+				},
+				"secret_mismatch": {
+					"description": "SecretMismatch is true when the active template version declares\n`coder_secret` requirements that the workspace owner's secrets do not\nsatisfy.",
+					"type": "boolean"
 				}
 			}
 		},