Allow secretspec to clean up orphaned secrets

[ap-1]

Moved from #237 (comment):

Currently, it is easy to remove unused/deprecated secrets from secretspec.toml and forget to remove them from the actual provider. Once secretspec can delete secrets, it should be able to take care of this for us by finding and deleting "orphaned" secrets no longer declared in secretspec.toml.

This should be a manual step, akin to how secretspec currently finds and prompts for missing secrets declared in secretspec.toml but not stored in the provider, since secretspec cannot know whether an undeclared secret is truly no longer in use (this is especially true for ref secrets / paths that lie outside of secretspec's {project}/{profile}/{key} structure)

This makes me think it should be a new flag on secretspec check, something like secretspec check --delete-orphaned, which is similar to secretspec import --delete-source implemented in #237. Alternatively, if a dedicated command is cleaner, something like secretspec sync would make sense.

[domenkozar]

This one is tricky to get right, especially if you've used ref.

We'd somehow have to keep state.

Also when switching between different branches this can get tricky.