Blocked by #807

Context

This issue has a lot of overlap with #681, and ideally a solution for this issue should consider both at the same time. If both are worked on at the same time, hopefully the total time complexity should be FEWER than the sum of each one

We need to account for this user flow:

1. Template admin creates a template
2. User creates a workspace from the template
3. Template admin updates the template to require a new secret
4. The template update means that the user will need to update their workspace
5. The user should be able to specify the secret value during the update process (but should only be prompted if the secret value is actually missing)