feat: add support for external secrets to the opensearch-sync service

[smlx]

This experimental change adds support for external secrets to the opensearch-sync service.

External secrets support defaults to disabled, but you can enable it via:

opensearchSync:
  externalSecrets:
    enabled: true

If external secrets are enabled, then the chart will no longer template a Secret object for the opensearch-sync service, and instead expects externally managed Secret objects to be created for it to consume.

The current chart errs on the side of a single source of truth for secrets shared between services. So, for example, the opensearch-sync service consumes the API_DB_PASSWORD out of the api-db secret, and the KEYCLOAK_CLIENT_SECRET out of the keycloak secret. The external secrets support in this PR defaults to the same design of having multiple services reference a single secret, but if a different design is easier to use for external secrets then that can be changed. For example maybe a single secret per service with duplicated secret values when they are shared between services makes sense, since the external secret store is the actual source of truth??

Also I assume you would need something like Stakater reloader to restart pods when secrets updated.

Feedback welcome. Including just closing this if you don't actually want to support external secrets this way 😄