Allow for fetching secrets in values from an k8s secret/other external source

**Is your feature request related to a problem? Please describe.**
Currently it seems that i need to provide all the values to my Helm charts directly within the CRD.
This isnt ideal, as sometimes helm charts need secrets passed to them and this makes rights mgmt a lot harder in an mutil-tenancy-environment where for example team a always provides a certain set of applications for teams b and . b cand c should always thee the status and some parts of the deployed config, but no secrets.
Right now this is basically impossible to achieve via RBAC.
Another issue is secret mgmt for example with sops.
Not having a dedicated resource that gets encrypted and separated from config makes secret mgmt in git harder than it needs to be.

**Describe the solution you'd like**
Have the option to separate your secret values from your general config.
One way that came into my mind is the way how the Flux Helm controller handels this, by allowing value file references, that get pulled in and merged together. Im not sure that would be the best solution to, as the coupling between a secret and an ApplicationGroup is always going to be loose.

**Describe alternatives you've considered**
none
**Additional context**
n/a