fix: credential secrets: avoid the race condition better (#2410)

[g-linville]

for #2410

Turns out my previous PR to fix this race condition introduced another problem. I was previously waiting until all containers in the app were marked as Defined in their status before prompting the user to fill in the credential secret, but the containers will never be Defined if their env references anything inside of the secret, since the secret needs to be created first.

This new approach is much better (shoutout to Mr. Thedadams for the solution). We bubble up the app that is returned from our Update and use that as the basis for the generation, and the user is prompted only one time as a result.

Checklist

• The title of this PR would make a good line in Acorn's Release Note's Changelog
• The title of this PR ends with a link to the main issue being address in parentheses, like: This is a title (#1216). Here's an example
• All relevant issues are referenced in the PR description. NOTE: don't use GitHub keywords that auto-close issues
• Commits follow contributing guidance
• Automated tests added to cover the changes. If tests couldn't be added, an explanation is provided in the Verification and Testing section
• Changes to user-facing functionality, API, CLI, and upgrade impacts are clearly called out in PR description
• PR has at least two approvals before merging (or a reasonable exception, like it's just a docs change)