The primary source of law is the various laws passed by Congress known as the FD&C Act and which is codified in the relevant part at 21 USC 352(e)(1)(A)(iii), which says
the established name of each inactive ingredient listed in
alphabetical order on the outside container of the retail package and,
if determined to be appropriate by the Secretary, on the immediate
container, as prescribed in regulation promulgated by the Secretary,
except that nothing in this subclause shall be deemed to require that
any trade secret be divulged, and except that the requirements of this
subclause with respect to alphabetical order shall apply only to
nonprescription drugs that are not also cosmetics and that this
subclause shall not apply to nonprescription drugs not intended for
human use.
That law gives regulatory power to some part of the executive branch to enforce these statutes, currently the Department of Health and Human Services. Only Congress has the power to make new law, but the courts and executive branch have the power to interpret existing law. So Congress can delegate to the executive branch the power to make certain decisions as to what the law specifically means, within the confines of the acts passed by Congress.
A regulation (encoded in 21 CFR) legally cannot conflict with a statute. Anything that a regulation requires, requires statutory authority. That does not mean that the executive branch is incapable of writing a regulation that contradicts the statutes. If there is actually a conflict, then a person affected might sue the agency which promulgated the regulation, arguing that they exceeded their authority. There is a legal doctrine known as Chevron deference that requires the courts to defer to the agency's interpretation of an ambiguous or unclear statute.
In terms of impelling a manufacturer's practical decision, this favors minding the regulations over the statutes for two reasons. First, unless it is clear that the executive branch has exceeded its authority, the courts will defer to the executive branch. Second, enforcement actions are primarily carried out by the executive branch.
Suppose that the executive branch plainly stated that trade secrets must be divulged to comply with labeling laws. As you can see from the statute, Congress enacted a trade secret exception. If 21 CFR explicitly said otherwise then an affected person might have a basis for a lawsuit against DHHS. DHHS might argue that this means that there can be no trade secrets in food, drugs of cosmetics, but that would be a serious violation of the liberty and commercial interests of manufacturers, which are protected by the Constitution. This could then trigger an inquiry into whether Congress had intended to outlaw trade secrets in this domain, and whether they have the authority to do so.
However, the regulations do not say that (as far as I can tell: you'd have to hire an attorney who totally knows that title). I do not know if any manufacturer believes that they are compelled to divulge trade secrets, and if so, what was the basis for that belief. If they were directed to some part of CFR that literally said they must, then I would expect an eventual legal challenge, because there is no unclarity to the statutory exemption. That does not mean that a manufacturer will not voluntarily reveal a supposed trade secret for a business reason.
The FDA's role is to evaluate the evidence for safety and effectiveness, which it primarily does via a scientific review panel. The FDA does provide some scientific guidance, such as Safety Testing of Drug Metabolites, which "represents the current thinking of the Food and Drug Administration", and doe not establish legally enforceable responsibilities. They say to discuss an alternative approach, contact the FDA. It applies to small molecule nonbiologic drug products, so specific details regarding vaccines isn't covered, but this should give you an idea what concern a manufacturer should address in their testing. For instance,
Based on the nature of the chemical reactions involved, metabolites
formed from Phase I reactions are more likely to be chemically
reactive or pharmacologically active and, therefore, more likely to
need safety evaluation
...
If at least one animal test species forms this drug metabolite at
adequate exposure levels ...it can be assumed that the metabolite’s
contribution to the overall toxicity assessment has been established...
Phase II conjugation reactions generally render a compound more water
soluble and pharmacologically inactive, thereby eliminating the need
for further evaluation. However, if the conjugate forms a toxic
compound such as acylglucuronide, additional safety assessment may be
needed
Potentially relevant to the specific question of 21 CFR 610.61[n], they state
Generally, metabolites identified only in human plasma or metabolites
present at disproportionately higher levels in humans than in any of
the animal test species should be considered for safety assessment.
Human metabolites that can raise a safety concern are those formed at
greater than 10 percent of total drug-related exposure at steady
state. The choice of a level of greater than 10 percent for
characterization of drug metabolites reflects consistency with FDA and
Environmental Protection Agency guidances.
This is really just the tip of the scientific iceberg, but should give you some idea. They have a brief piece on vaccines here, a general FAQ, CDC's somewhat more informative account of the approval process for vaccines, and a FAQ-style discussion of some popular ingredients.
Basically, the reason why the law is unclear on what constitutes a safety concern is that it is a scientific question, and Congress delegated authority to make that determination to the FDA.