Also check for secret storage provider before using old API (#187105)

This allows a nice migration path for web environments:
1. Embedder implements a secret storage provider in addition to the credentials provider they already have
2. Wait a release or 2
3. Remove the credentials provider from the embedder

Once all known embedders do number 1, we can delete the `_oldMainThreadSecretState` entirely.