feat: add cog.Secret input support to coglet (#3057)
* feat: add cog.Secret input support to coglet
Classify and coerce Secret, Optional[Secret], and Secret | None fields,
wrapping plain string values in cog.types.Secret (list[Secret] is
intentionally not coerced).
Add the hello-replicate example which demonstrates Secret usage by calling
the Replicate API.
* chore: ignore pyo3 0.27 advisories in cargo-deny
Pinned to pyo3 0.27 due to numpy/pyo3-async-runtimes lag; neither
vulnerable code path is reachable in coglet.
* test: add runtime Secret coercion coverage; address review feedback
- Add active coglet-python pytest coverage asserting predictors annotated
with Secret receive a cog.Secret whose get_secret_value() round-trips,
covering Secret, Optional[Secret], Secret | None, plus negatives
(plain str stays str, omitted Optional[Secret] stays None).
- Narrow input.rs doc comments so they no longer imply list[Secret] is
classified/coerced (Secret supports only direct Secret, Optional[Secret],
and Secret | None).
- Update hello-replicate README to recommend passing the token via an
environment variable instead of a literal on the command line, and note
that cog.Secret cannot protect secrets exposed by the user's shell.
