Fix bad depends on

[Jeffreyhung]

The change will prevent future secret changes from triggering a rebuild on all cloud functions and containers.
It is possible that when new secret is added, there will be some race condition error that happens, but as stated in secret readme things might not work in the first tf apply run anyway, so I consider this as an acceptable breaking change.

[github-actions]

Terraform plan in .

Plan: 1 to add, 1 to change, 1 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # module.functions.module.cloud_function_gen2["example-gen2-cron"].google_cloudfunctions2_function.function will be updated in-place
  ~ resource "google_cloudfunctions2_function" "function" {
        id               = "projects/jeffreyhung-test/locations/us-west1/functions/example-gen2-cron"
        name             = "example-gen2-cron"
        # (11 unchanged attributes hidden)

      ~ build_config {
            # (7 unchanged attributes hidden)

          ~ source {
              ~ storage_source {
                  ~ object     = "src-90ebbf1bfdc8d1b0c1deff70132cdc47.zip" -> "src-03bdfabf8c7adb2ef887fe89f69a0dbe.zip"
                    # (2 unchanged attributes hidden)
                }
            }
        }

        # (1 unchanged block hidden)
    }

  # module.functions.module.cloud_function_gen2["example-gen2-cron"].google_storage_bucket_object.zip must be replaced
-/+ resource "google_storage_bucket_object" "zip" {
      + content             = (sensitive value)
      ~ crc32c              = "N2/bfA==" -> (known after apply)
      ~ detect_md5hash      = "kOu/G/3I0bDB3v9wEyzcRw==" -> "different hash"
      - event_based_hold    = false -> null
      ~ generation          = 1746817392822887 -> (known after apply)
      ~ id                  = "********************************************************************************" -> (known after apply)
      + kms_key_name        = (known after apply)
      ~ md5hash             = "kOu/G/3I0bDB3v9wEyzcRw==" -> (known after apply)
      ~ media_link          = "https://storage.googleapis.com/download/storage/v1/b/jeffreyhung-test-cloud-function-staging/o/src-90ebbf1bfdc8d1b0c1deff70132cdc47.zip?generation=1746817392822887&alt=media" -> (known after apply)
      ~ name                = "src-90ebbf1bfdc8d1b0c1deff70132cdc47.zip" -> "src-03bdfabf8c7adb2ef887fe89f69a0dbe.zip" # forces replacement
      ~ output_name         = "src-90ebbf1bfdc8d1b0c1deff70132cdc47.zip" -> (known after apply)
      ~ self_link           = "https://www.googleapis.com/storage/v1/b/jeffreyhung-test-cloud-function-staging/o/src-90ebbf1bfdc8d1b0c1deff70132cdc47.zip" -> (known after apply)
      ~ storage_class       = "STANDARD" -> (known after apply)
      - temporary_hold      = false -> null
        # (8 unchanged attributes hidden)
    }

Plan: 1 to add, 1 to change, 1 to destroy.

✅ Plan applied in Terraform Apply #37