Provision native Kubernetes resources for shared-storage secrets

Description

Have NVCA manage the Kubernetes resources used to deliver per-function sensitive data: runtime and metadata Secrets, the utility ServiceAccount and RBAC, an HCL ConfigMap, and an optional NetworkPolicy. Limit the writer Role to get and patch on the two named Secrets through resourceNames. Render the secret references into the per-function HCL configuration and attach the resources to the StorageRequest ownership lifecycle.

Definition of Done

• Creation, update, idempotency, owner references, and cleanup are covered by tests.
• RBAC grants only the required verbs on the named Secrets.
• Runtime data remains available at /var/secrets/secrets.json and metadata at /var/run/nvcf/info/self.
• Native resources are not created when secretBackend=smb or shared-storage configuration is omitted.