Allow ticktick-client-secret to be a function

[tino415]

The README recommends storing the client secret with auth-source. That is already possible by looking it up when the init file is evaluated:

(setq ticktick-client-secret (auth-source-pick-first-password :host "ticktick.com"))

but doing it eagerly means an encrypted authinfo file is decrypted at startup — a GPG passphrase prompt in every session, whether or not TickTick is used that session — and the plaintext secret then sits in a variable for as long as Emacs runs.

This allows ticktick-client-secret to also be a function of no arguments, deferring the lookup to the moment a token is actually requested:

(setq ticktick-client-secret
      (lambda ()
        (auth-source-pick-first-password :host "ticktick.com" :user ticktick-client-id)))

It is called at authorization and on token refresh, so nothing is decrypted until it is needed.

Notes:

• Backward compatible: a plain string behaves exactly as before.
• A single accessor, ticktick--client-secret, resolves the value. All three read sites go through it: ticktick--authorization-header, ticktick-debug-oauth, and the guard in ticktick-authorize.
• The stringp conjunct in that guard had to be dropped rather than wrapped, since it is what rejected a function value outright. The string-empty-p check on the resolved value still covers both the unset and the failed-lookup cases.
• The accessor returns "" when the function yields nil (e.g. an auth-source miss), so a miss gives the existing "must be set" user-error rather than a wrong-type-argument crash.

Verified with emacs -Q --batch: byte-compiles and passes checkdoc with no new warnings, and the string and function forms produce identical Authorization headers.