secrets: `clean` doesn't toggle the `active` field in obsolete/expired gitlab tokens

I expected clean to deactivate gitlab tokens once there's a new version of them deployed, or otherwise the docs should be clearer how to deal with expired and unused tokens.