Unfortunately, we need a way to populate the session token field duringRead for imports, so we do a redundantPatch. One improvement would be to modifycodersdk and make the other fields onPatchWorkspaceProxy optional.

This makes the old token invalid. There's no way to read the secret from the API except on create intentionally (it's like a password), so I'd rather we just blocked imports.

There still should be some way to regenerate the token on request, though. I'm not sure how to do that idiomatically in TF.

I also don't mind not allowing regeneration for now until we come up with a better solution. Admins can seamlessly add and remove wsproxies live from a deployment and DERP map updates will be pushed out to all tailnet clients within a minute.

Given the token lasts forever, I think we're all good to just not allow regenerations and imports, at least for now.

Should not regenerate without the user requesting it.