Not a bullet proof solution, but I have implemented an increased level of security by using EncryptSymmetric and DecryptSymmetric, so you avoid storing the id and secret directly in Ampscript.
First you create the three required assets in Key Management:
You need to use the EncryptSymmetric in a different Cloud Page to ...
You can use SSL mutual authentication, where the endpoint can verify the certificate used, or you could use an IP address white list using the published IP address ranges for Salesforce. Both of threat techniques can be used to verify that a request is authentic.
Seems like a validation rule would do the trick.
I'm assuming the following:
-the picklist would be empty until it is entered by the user, in which case it should now not be editable to all except Admin profiles.
$User.ProfileId <> 'put ...
SELECT Id,Name,ParentId,SystemModstamp,Visibility FROM PermissionSetTabSetting where Parent.Profileid='00000000000'
You can only manipulate the tab as long as it is Default On or Default Off.
Download the results.
Delete the rows that you want to keep.You will have list of records that you wanna remove.
All you have to do is delete that record by Id.