This allows the serialization used by dynamic providers to capture secrets, and if so, marks the resulting input value as a secret so that the `__provider` property will be a secret in the state.

The `__provider` property will no longer always be a secret. It will only be marked as a secret if a secret was captured during serialization of the provider.

Note: Previously, it wasn't possible to capture Outputs when serializing the resource provider. This change makes it possible and allows secrets to be captured.

By default, we continue to always make `__provider` a secret, unless `auto_secret` is set to `True`, in which case we only make `__provider` a secret if any secret Outputs were captured.

This commit renames `auto_secret` to `serialize_as_secret_always` and changes the polarity. `serialize_as_secret_always` defaults to `True`, which is the current behavior. A subclass can set it to `False` to make the serialized provider a secret only if any secret Outputs were captured, otherwise, it will not be a secret.

ParamSpec isn't available in Python 3.8. For our usage, it's sufficient to relax the typing.