Inject secrets into Daytona sandboxes safely and restrict sandbox network egress

Documented steps

1. Create an organization-scoped secret: `daytona.secret.create(CreateSecretParams(name='my-secret', value='...', description='...', hosts=['api.example.com']))`; the TypeScript form takes an object with the same fields.
2. Always populate `hosts` with hostnames only (no protocol, port or path); wildcards such as `*.example.com` are supported. Omitting hosts leaves the secret unrestricted, which the docs advise against.
3. Map the secret to an environment variable at sandbox creation via the `secrets` parameter, e.g. `secrets={'MY_API_KEY': 'my-secret'}`.
4. Understand what lands in the sandbox: the environment variable receives an opaque placeholder token of the form `dtn_secret_<random_string>`, never the plaintext value.
5. In sandbox code read the env var normally and send it in an HTTPS request header such as `Authorization` or `X-Api-Key`; the egress proxy substitutes the real value only when the destination host matches the secret's allowlist.
6. Verify against the real authenticated endpoint and check for a 200 — echo services give false negatives because response scrubbing rewrites any echoed secret back to the placeholder.
7. Change secrets on a running sandbox with `sandbox.update_secrets({'MY_API_KEY': 'my-secret'})`, or detach everything with `sandbox.update_secrets({})`.
8. Rotate credentials centrally with `daytona.secret.update(secret_id, UpdateSecretParams(value='new-value', hosts=[...]))`; the placeholder stays constant and the change takes effect in all sandboxes that use the secret within 15 seconds.
9. Restrict egress at creation by setting at most one of `network_allow_list` (comma-separated IPv4 CIDRs, max 10), `domain_allow_list` (comma-separated domains, wildcards allowed, max 20), or `network_block_all=True`.
10. Adjust restrictions at runtime with `sandbox.update_network_settings(...)`; CLI equivalents are `daytona create --network-allow-list '...'` and `--network-block-all`. Official docs: https://www.daytona.io/docs/en/secrets, https://www.daytona.io/docs/en/network-limits