Have the secrets generator always do an apply for rails secrets
But have it first populate the variables using any existing secret data
it finds

This allows us to generate secrets for new keys added in new gitlab
versions, while still respecting/retaining any existing key values.