Relabelling a sandbox into a secret's scope takes effect at once

Changing a running sandbox's labels so a scoped secret reaches it (or no longer does) now waits until its server holds the change, and the answer carries secretsEnforced: true (for a key that may read secrets; any other key's relabel takes up to 15 seconds, as before). Before, requests could go out without the value for up to 15 seconds after the label call returned. See Security.