Ensure any newly generated secrets get propagated correctly

With !1027 (merged) we replaced the secrets propagation system to be in memory instead of requiring NFS.

One scenario not accounted for was the "in-flight" generation of secrets. For example an existing environment that has secrets files in place but they get updated with a newly added secret on upgrade. The current system doesn't update it's copy of secrets on the fly in this situation so the new secret is not propagated fully until a subsequent run.

Task is to fix this and check secrets dynamically and update accordingly.