`get-resource-token` action should support passing token in as a secret

Filed by @canonical/solutions-qa

The `get-resource-token` action expects the token to be passed in as plaintext. This is then stored in the juju db as plaintext. It would be safer to support passing in a juju secret name.
```
actions:
...
- _id: cb9f8b08-9597-4677-8fac-d4317c2381f3:2
completed: "2026-05-29T13:16:35Z"
enqueued: "2026-05-29T13:16:27Z"
message: ""
messages: []
model-uuid: cb9f8b08-9597-4677-8fac-d4317c2381f3
name: get-resource-token
operation: "1"
parameters:
contract-token: *****************
receiver: canonical-livepatch-server-k8s/0
results:
result: resource token set
return-code: 0
started: "2026-05-29T13:16:27Z"
status: completed
txn-revno: 4
```

Start by locating the implementation of the get-resource-token action and trace how its contract-token parameter is stored in the Juju database. Check how Juju secret names are handled elsewhere in the project, if applicable. Done means the action can accept a Juju secret name without storing the token as plaintext, with coverage for the new input.

Written by the indexing model from the issue text.