Get the tenant's selected secret provider

Returns the secret provider selected for the tenant, identified by its type. When no tenant provider is selected the tenant inherits the application default and ultimately the read-only environment floor. Plaintext secrets and credential references are never returned; the response reports only the credential mode together with the partition strategy and instance id that determine how addresses are sharded.