Make SecretProtocol.Create idempotent

[carolynvs]

Porter would like to be able to call SecretProtocol.Create more than once, for example when performing a migration that fails half way through and is repeated. Right now that doesn't work because the implementation for Create uses the Create function. If we instead either looked up the record and did an Update if it already exists, or use Apply, then it would be safe to call multiple times.