clanCore/vars/sops: only copy required secrets to store

Create a store path per in repo secret/var to be copied, this prevents
unused secrets from being leaked.

For example the `root-password` generator contains both the hashed and
unhashed password but only the hash is used.

pkgs/clan-cli/clan_cli/tests/test_vars.py

@@ -970,7 +970,7 @@ def test_dynamic_invalidation(
     custom_nix.write_text(
         """
         { config, ... }: let
-            p = config.clan.core.vars.generators.my_generator.files.my_value.path;
+            p = config.clan.core.vars.generators.my_generator.files.my_value.flakePath;
         in {
             clan.core.vars.generators.dependent_generator.validation = if builtins.pathExists p then builtins.readFile p else null;
         }