feat: implement secret mgmt apis

[andyatmiami]

closes: #844

Replace stub/mock secret repository with real Kubernetes API interactions and add a metadata-only cache for listing secrets safely.

Business logic:

• CRUD operations using controller-runtime client against real K8s Secrets
• Label-based access control: can-update=true required for PUT/DELETE
• 3-way update semantics: set (base64 provided), preserve (empty {}), or delete (key omitted) individual secret keys
• Cross-reference resolution: list response includes workspaces that mount each secret via buildSecretMountMap()
• Created secrets automatically labeled with can-mount=true and can-update=true
• Secret values are never returned in any API response

Metadata-only cache:

• Disable default controller-runtime Secret caching (memory/security)
• Add BuildSecretMetadataClient() using PartialObjectMetadata informer so only ObjectMeta is held in memory, not secret data values
• List endpoint uses metadata cache; Get/Create/Update/Delete use direct API calls
• Comment out Type/Immutable from SecretListItem (not available from PartialObjectMetadata) with TODO to discuss resolution

Handler fixes:

• Reorder UpdateSecretHandler: validate body before auth check
• Add ErrSecretNotCanUpdate → 400 handling to Update and Delete
• Add apierrors.IsInvalid → 422 handling to Create and Update
• Fix Swagger annotations (@param body type, missing @failure codes)

Tests:

• Rewrite secrets_handler_test.go with 28 test cases covering CRUD, label-based access control, cross-references, empty lists, and K8s state verification

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from andyatmiami. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• workspaces/backend/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment