Quick follow up to PR #2781, this commit does the same kind of logic but for machines instead of users and groups. Note that this only affects the `clan secrets machines remove` sub-command, and that `clan machines delete` still leaves unusable secrets & vars behind. This can be addressed in a different change.