* fix: compare fork secret variables by decrypted value
* test: restore MIN_VERSION even when the secret compare test fails
* fix: re-evaluate cached variable diffs once after the secret compare fix
* refactor: decrypt already-loaded secret rows when comparing variables
* docs: state the authorization contract of decrypt_secret_value
* fix: compare external-backend secrets by their resolved values
---------
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
