[JUJU-1693] Add secret-get --metadata and enforce label uniqueness

[wallyworld]

Add a new secret-get --metadata command to fetch just secret metadata.
Also enforce unique labels.
And cleanup some issues with the secret collections in mongo.

Checklist

• Code style: imports ordered, good names, simple structure, etc
• Comments saying why design decisions were made
• Go unit tests, with comments saying what you're testing
• [ ] Integration tests, with comments saying what you're testing
• [ ] doc.go added or updated in changed packages

QA steps

deploy ubuntu charm

juju exec --unit ubuntu/0 "secret-add data=foo --label=foo"
secret:cc452i9vd6n21aea8d00

juju exec --unit ubuntu/0 "secret-get secret:cc452i9vd6n21aea8d00"
data: foo

juju exec --unit ubuntu/0 "secret-get secret:cc452i9vd6n21aea8d00 --metadata"
cc452i9vd6n21aea8d00:
  revision: 1
  label: foo
  rotation: never

juju exec --unit ubuntu/0 "secret-get secret:cc452i9vd6n21aea8d00 --metadata --label foo"
ERROR specify either a secret URI or label but not both to fetch metadata

juju exec --unit ubuntu/0 "secret-get --metadata --label foo"
cc452i9vd6n21aea8d00:
  revision: 1
  label: foo
  rotation: never

juju exec --unit ubuntu/0 "secret-add data=foo --label=foo"
ERROR secret with label "foo" already exists

[wallyworld]

/merge