fix(secrets): unfreeze non-secret updates on a setOnce secret