Is there a way to get a secret object into the top-level project configuration? I have a secret object I want to be used by all stacks but it seems top-level configuration only supports strings

Not currently. https://github.com/pulumi/pulumi/issues/11549 is tracking adding support for this.