fix: bump a volume mount's version when the secret behind it changes

[nilsonfh]

What this fixes

PATCH /api/v3/secrets/<name> updates the secret and marks change tracking for the
linked nodes, but nothing bumps the version of the volume mounts that carry it. An
agent only re-materialises a mount whose version is greater than the one it holds —
Skipping update - new version 1 not greater than current version 1 in its journal —
so every linked node keeps the old content indefinitely.

The effect is that any rotation of publisher keys, credentials or TLS material looks
applied in the Controller and is not applied on the fleet.

updateSecretEndpoint now bumps every volume mount that references the secret, inside
the same transaction that writes it.

How it was found

Measured on Controller 3.8.2 with Edgelet v1.0.3-rc.1, on a node linked to a
secret-backed volume mount used to distribute container-signature public keys:

• Adding a key through the secrets API alone changed nothing on the node, for as long
  as it was left alone.
• Only a PATCH /api/v3/volumeMounts/<name> — which does bump the version — made the
  new key arrive, which is the workaround the lab's tooling had to carry.
• With this change, the secrets API call alone moved the mount's version and the node
  had the new file about 30 s later. Removing the key propagated the same way.

Why the bump is unconditional

A PATCH is an explicit instruction to set this secret, and the stored copy lives in
the vault, so "bump only when the data differs" is not a hash of the request body. An
attempt at the conditional version also behaved differently depending on which of the
request's two executions ran first — a PATCH with new data bumped the version twice
and one with identical data once, although the route is registered once and its
middleware calls the endpoint once. That duplication is worth a look on its own and is
unrelated to this fix; an agent only needs a strictly greater version and
re-materialises once per change it sees.

Scope and risk

One file, 21 added lines, no API change. A node re-reads a secret-backed mount after
its secret is updated, which is the documented intent of the endpoint.

Verification

npx standard@17 clean on the changed file (same version as the repo's
devDependency).

Note: npm ci fails on develop for an unrelated reason (ERESOLVE:
sinon-chai@3.7.0 wants chai@">=2.1.2 <6", the tree has chai@5.1.1 via
chai-as-promised), so the test suite was not run here.

🤖 Generated with Claude Code