Disabled secrets cause OAuth clients to be flagged

[achave11-ucsc]

[hannes-ucsc]

The intention was to keep the disabled secret until a new secret needs to be added. This clearly doesn't work as haven two secrets causes the flag, even if there is only one enabled secret. Assignee to file PR that modifies _provision_oauth2_client_secret to remove the deletion step from the pre-paste instructions and instead add a step to the post-paste instructions to delete all clients.

[hannes-ucsc]

For demo, show that no secrets are flagged in any of the five GCP projects.