v0.37.0

Part A of the attach-credentials proposal. AttachOptionSpec gains a
secret flag, carried as a nullable boolean column "secret" appended
after "required" in the one-row spec batch and read by column name;
absent or null means false, so older peers interoperate unchanged.

• vgi: AttachOptionFlags { required, secret } and
  serialize_attach_option_spec_with_flags; serialize_attach_option_spec
  keeps its signature and writes secret = false. Adds
  secret_attach_option_names alongside required_attach_option_names.
• vgi-client: AttachOptionSpec.secret, decoded by name, shown in Debug.
• vgi-example-worker: attach_options_required's api_key is now secret.
• Rustdoc: credential options must be declared secret; clients and the
  DuckDB extension mask them, keep them out of cache keys and logs, and
  can supply them from a vgi_attach DuckDB secret.

Co-Authored-By: Claude Opus 5.5 (1M context) noreply@anthropic.com