Feature: source token_reviewer_jwt from a Secret in KubernetesAuthEngineConfig

[clarlam]

Summary

KubernetesAuthEngineConfig can currently set token_reviewer_jwt only via
tokenReviewerServiceAccount, which mints a JWT for a ServiceAccount in the operator's own
cluster (TokenRequest API). But spec.kubernetesHost accepts any URL — when the TokenReview
endpoint is not the local API server, a locally-minted SA JWT is not a valid credential, and the
CRD cannot configure the backend correctly.

Proposal: add tokenReviewerJWTSecret (a SecretKeySelector) to source the reviewer credential
from a Secret.

Use cases

1. Remote cluster: the operator manages an auth backend whose kubernetesHost points at a
   different cluster; local SA JWTs are meaningless there.
2. Authenticating proxy / API gateway in front of the API server (Rancher, Teleport, managed
   frontends): these accept their own bearer credentials, not SA JWTs.
3. Externally-managed reviewer credential: rotation owned by another system that maintains a
   Secret (e.g. via external-secrets).

Note Vault itself treats token_reviewer_jwt as an opaque bearer string — the CRD is currently
more restrictive than the API it manages.

Current behavior that blocks workarounds

toMap() always includes token_reviewer_jwt in the payload (empty string when no SA is set),
and Vault clears the stored value on an explicit "". So a reviewer written out-of-band (CLI,
Terraform) is wiped on the operator's next write — the config object can't be co-owned.

Proposed API

spec:
  path: mycluster
  kubernetesHost: https://gateway.example.com/cluster-a
  kubernetesCACert: |
    ...
  tokenReviewerJWTSecret:      # NEW — takes precedence over tokenReviewerServiceAccount
    name: reviewer-credential
    key: token                 # optional, defaults to "token"

• Secret is read from the CR's namespace during PrepareInternalValues, populating the same
  internal value the SA path uses today.
• Mirrors the existing secret-sourcing pattern in DatabaseSecretEngineConfig.rootCredentials
  (a vaultSecret variant could follow the same shape later).
• Possible follow-up: watch referenced Secrets to re-reconcile on rotation, as
  GitHubSecretEngineConfig does for its SSH-key Secret.