fix(secrets): inherit opacity for a reference into a map-shaped secret