Set function secret

Create or update a secret on a function. Marks the function out-of-sync; the next POST /deploy re-publishes the function with the new environment. Keys must match [A-Z_][A-Z0-9_]* (uppercase env-var style), be at most 64 characters, and not start with a prefix the runtime reserves: AWS_, _AWS_, LAMBDA_, _HANDLER, _X_AMZN. Those are refused with 400.