Reject stale OpenAPI secret bindings before submit

[dmmulroy]

Summary

• add OpenAPI secret binding validation for selected secret id and credential scope
• block Add OpenAPI submit when a selected secret no longer exists before creating the source
• cover existing, deleted, and wrong-scope secret selections

Verification

• bunx oxfmt --check packages/plugins/openapi/src/sdk/secret-binding-validation.ts packages/plugins/openapi/src/sdk/secret-binding-validation.test.ts packages/plugins/openapi/src/react/AddOpenApiSource.tsx
• bunx oxlint -c .oxlintrc.jsonc --deny-warnings packages/plugins/openapi/src/sdk/secret-binding-validation.ts packages/plugins/openapi/src/sdk/secret-binding-validation.test.ts packages/plugins/openapi/src/react/AddOpenApiSource.tsx
• bun run --cwd packages/plugins/openapi test -- src/sdk/secret-binding-validation.test.ts
• bun run --cwd packages/plugins/openapi typecheck