Create or update workspace secrets in a batch

Stores a confirmed batch of workspace secrets encrypted, all or none. created and updated list which names were new and which replaced a stored value. Omitting a variable's note keeps its stored note. Refused names are listed in invalid_names, with a reason and message each in invalid. Values are never returned.

_{Scope: secrets:write}