GetSecretToBeReplaced - Retrieves the secret entity that needs to be replaced
with data still encrypted and secure fields removed. This differs from
because in this case we know this is for secret replacement,
which can be challenged.