Measuring the Leakage and Exploitability of Authentication Secrets in Super-apps: The WeChat Case