feat(secret): add Cache.Invalidate to drop a cached secret on rotation

[jpugliesi]

secret.Cache caches GetSecretValue results under a TTL but exposes no way to evict an entry. A caller that rotates or deletes a secret through the underlying manager keeps reading the stale cached value until the TTL elapses — there's no way to force a re-read.

This adds Invalidate(name):

// drop the cached current-version entry after a write/delete
cache.Invalidate(name)
// next unversioned read re-fetches from the provider
v, _, _ := cache.GetSecretValue(ctx, name)

Behavior

• Drops only the current-version entry (cacheKey{name}), which is the one that can go stale after a rotation/delete.
• Version-pinned entries are left intact — a specific secret version is immutable, so its cached bytes never go stale.
• One-liner over the existing cache.TTL.Drop; no new state.