AUT-11295 Manage workspace secrets via dedicated secrets pipeline

[piotrek-janus]

Jira task - https://secureauth.atlassian.net/browse/AUT-11295

Release Notes Description (public)

Manage workspace secrets as config-as-code using the dedicated secret system APIs. New --workspace-secrets <workspace> flag on pull, push, and diff operates exclusively on secrets: pull scaffolds env-injected stub files, push reconciles remote secrets from local definitions (create/update, delete with --prune), and diff compares local definitions against the remote workspace. Secret values are never stored in the repository — each secret file references an environment variable resolved at push time.

Implementation details (internal)

Alternative to #30 (same Jira). Instead of threading a Patch/Ext envelope through every Source/Storage/Validator/diff signature, secrets get a self-contained vertical slice; the existing config pipeline is untouched.

• internal/cac/secrets: local model, pure plan computation (ComputePlan → create/update/delete sets), and DirStore for workspaces/<wid>/secrets/*.yaml. ListIDs reads raw YAML (no env vars needed, used by pull/diff); List renders {{ env }} templates and rejects empty values before any API call (used by push).
• internal/cac/client/secrets_api.go: SecretsAPIStore over the system Secrets CRUD API.
• Stub format: value: '{{ env "CAC_SECRET_<ID>" }}' — single-quoted so files parse as plain YAML while remaining valid Go templates. pull never overwrites existing secret files.
• --workspace-secrets is mutually exclusive with --workspace/--tenant/--filter; push --method and diff --source/--target are validated in RunE so they stay required for config mode only.
• Secret values never appear in logs, plan summaries, or dry-run output — IDs only. push --dry-run prints exactly the plan a real push would apply.

Information for QA

• Is QA testing required?
• Does PR contain unit tests?
• Should QA create E2E tests for the change?

Additional QA Procedures (Optional)

Suggested manual flow against a dev tenant: pull --workspace-secrets <wid> (stubs created, re-run skips), set CAC_SECRET_* env vars, push --workspace-secrets <wid> --dry-run (plan lists IDs only), real push, diff --workspace-secrets <wid>, and push --prune after deleting a local file.