Add a KV/Vault/secrets-manager binding

[JSONbored]

Problem: No dedicated secrets-manager binding exists today — secrets are handled as plain environment variables/Cloudflare secrets.

Area: ORB / Security

Proposal: Add a proper secrets-manager binding suited to holding many customers' worth of credentials, appropriate to whichever cloud substrate the hosted product ultimately runs on.

Deliverables:

• A working secrets-manager integration.

[linear-code]

JSO-3583

[JSONbored]

Likely narrows significantly once #7174 (broker generalization) lands — the KV/Vault question becomes 'what does the broker's own cache/storage sit on', not a separate secrets-manager integration. Revisit scope after #7174.

[JSONbored]

Superseded — converged into #5225's design. Cloudflare Secrets Store answers this (no separate third-party KV/Vault binding needed); see #5225 for the full design.