v2.2.1: fix: handle expired secrets just like non existing secrets

To avoid leaking information the user should not know why she can't read
a secret because it's expired or has no more remaining reads, so return
404.