v0.37.1 — secret-dependent cacheable fixtures

Fixtures: secret-dependent results are now cacheable

The vgi extension (d91b7c4) no longer refuses to result-cache a function that depends on a DuckDB secret. It keys the result on a fingerprint of the secrets the bind resolved, never their values. The result is reused while the secret is unchanged and recomputed as soon as it is rotated, any of its fields changes, or it is dropped.

Three fixtures back the conformance test cache/secret_scope.test, one per cache path:

• secret_cache_nonce(): producer that declares the vgi_example secret. It is also the inline-bound data.secret_cache_nonce table.
• secret_cached_scalar(x): scalar with the per-value cache.
• secret_cached_lateral(x): blended map with the per-value cache that requests the secret during bind.

Each fixture returns the secret's secret_string and a random nonce generated only when the worker really runs. A matching nonce shows the result came from the cache; a new one shows the worker ran.