make bestEffortFixApplicationSecret public and allow providing the replacement value

We want to use this when cloning templates for bundling.
We'll replace the secret with some kind of FIXME value.