fix(secrets): Avoid count underflow by only counting initialized secrets

[srebhan]

Summary

Currently, a secret-count underflow can occur if uninitialized secrets are destroyed. This can for example be triggered by the following config part

[[secretstores.os]]
  id = "secrets"
  keyring = "telegraf"

without actually referencing any secret. In this example, the password setting of the secret-store is not set and thus the struct's "secret" member is not initialized (init(...) is not called). As a consequence we do not count the secret. However, when the Init() function in the OS secret-store terminates it calls Destroy() on the password secret which unconditionally subtracts one from the secret count. Remember, the password secret was not initialized and thus not counted in the first place! As a result, the count underflows.

This PR only counts initialized secrets (as only those use locked memory) in both positive and negative direction. Furthermore, we provide a safety-net telling the user to report unusual (negative) values and clip the count to not confuse users.

Checklist

• No AI generated code was used in this PR

Related issues

superseeds #14986

[telegraf-tiger]

Download PR build artifacts for linux_amd64.tar.gz, darwin_arm64.tar.gz, and windows_amd64.zip.
Downloads for additional architectures and packages are available below.

⚠️ This pull request increases the Telegraf binary size by 2.97 % for linux amd64 (new size: 231.4 MB, nightly size 224.8 MB)

📦 Click here to get additional PR build artifacts

Artifact URLs

DEB	RPM	TAR GZ	ZIP
amd64.deb	aarch64.rpm	darwin_amd64.tar.gz	windows_amd64.zip
arm64.deb	armel.rpm	darwin_arm64.tar.gz	windows_arm64.zip
armel.deb	armv6hl.rpm	freebsd_amd64.tar.gz	windows_i386.zip
armhf.deb	i386.rpm	freebsd_armv7.tar.gz
i386.deb	ppc64le.rpm	freebsd_i386.tar.gz
mips.deb	riscv64.rpm	linux_amd64.tar.gz
mipsel.deb	s390x.rpm	linux_arm64.tar.gz
ppc64el.deb	x86_64.rpm	linux_armel.tar.gz
riscv64.deb		linux_armhf.tar.gz
s390x.deb		linux_i386.tar.gz
		linux_mips.tar.gz
		linux_mipsel.tar.gz
		linux_ppc64le.tar.gz
		linux_riscv64.tar.gz
		linux_s390x.tar.gz

[powersj]

Thanks for digging into this a bit more!