A development team stores database passwords, third-party API tokens, and TLS private keys directly in application source code and environment variable files checked into their Git repository. The security team wants a centralized, audited service where these credentials are stored encrypted at rest, retrieved by applications at runtime via IAM-controlled access, and versioned so a compromised credential can be rotated without code changes. Which Google Cloud service should the team adopt for storing and serving these credentials?