After secrets are ensured, delete older secrets with the same jenkins.portainer.secret/base label but a different hash name.

Failures (secret still in use) are logged; the step does not fail.