Backport of add interpolation support in env stanzas for secret providers into release/1.11.x

[hc-github-team-nomad-core]

Backport

This PR is auto-generated from #27568 to be assessed for backporting due to the inclusion of the label backport/1.11.x.

The below text is copied from the body of the original PR.

---

Summary

• Add variable interpolation support for env {} values in the secret stanza when using custom plugin providers
• Enables references like ${secret.X.Y}, ${node.*}, and ${NOMAD_*} inside plugin env blocks
• Template-based secrets (nomad, vault) resolve first, then their values are interpolated into plugin env maps before Fetch() is called

Context

#27569

Implementation

The interpolation machinery already exists in helper/args.ReplaceEnv and taskenv.TaskEnv.ReplaceEnv — it just wasn't wired up for the secret.env block.

Changes:

1. Add SetEnv(map[string]string) to the SecretsPlugin interface and implement it on externalSecretsPlugin. This allows updating a plugin's environment variables after construction.
2. Add InterpolateEnv(rawEnv, interpolate) to ExternalPluginProvider. Applies an interpolation function to all env values and updates the underlying plugin via SetEnv.
3. client/allocrunner/taskrunner/secrets_hook.go — Two changes:
   • buildSecretProviders() now also returns the raw env maps alongside the plugin providers
   • Prestart() interpolates plugin env values after h.envBuilder.SetSecrets(m) (template secrets resolved) but before the plugin Fetch() loop, using taskEnv.ReplaceEnv which already supports ${secret.*}, ${node.*}, and ${NOMAD_*} references

Scope

• Template-to-plugin interpolation only (nomad/vault secret → plugin env)
• Plugin-to-plugin chaining (plugin A's secrets in plugin B's env) is not in scope — plugins are fetched sequentially, but env interpolation happens once before all fetches. This could be added later with per-plugin lazy interpolation if there's demand.

Testing

• New integration test in secrets_hook_test.go: sets up a Nomad variable server returning token=my-secret-token, creates a bash plugin that echoes back ${SERVICE_TOKEN}, configures the plugin's env with SERVICE_TOKEN=${secret.creds.token}, and asserts the plugin receives the interpolated value
• New unit test in plugin_provider_test.go: verifies InterpolateEnv correctly applies the interpolation function and calls SetEnv with the result
• All existing tests continue to pass

---

Overview of commits

• 3ebb93d