Support read RDS secret from file

# Summary

Argo workflow read [MYSQL secret ](https://github.com/argoproj/argo-workflows/blob/master/manifests/quick-start/mysql/argo-mysql-config-secret.yaml) through [k8s API call](https://github.com/argoproj/argo-workflows/blob/master/persist/sqldb/sqldb.go#L43) instead of a file, which can be mounted to the pod through secret volume or emptyDir volume(injected by vault).

What change needs making?

1. Add a secretFilePath filed in the [workflow-controller-configmap.yaml](https://github.com/argoproj/argo-workflows/blob/master/manifests/quick-start/mysql/overlays/workflow-controller-configmap.yaml#L16-L21)
2. Use the secret from the file to create DBSession if the filePath is not empty, otherwise read it from secret objects.

# Use Cases

Our RDS password is stored in the vault and we use [vault + k8s](https://github.com/hashicorp/vault-k8s) which mounts the secret file to the emptyDir volume of the argo-workflow pod. https://www.vaultproject.io/docs/platform/k8s/injector

When would you use this?

We would expect to support this feature in the next release.

---

**Message from the maintainers**:

Love this enhancement proposal? Give it a 👍. We prioritise the proposals with the most 👍.

Start with persist/sqldb/sqldb.go and the MySQL configuration in manifests/quick-start/mysql/overlays/workflow-controller-configmap.yaml, then inspect how the workflow-controller configuration creates the DBSession. Verify the existing Kubernetes secret path and the mounted-file use case described in the issue. Done means a non-empty secretFilePath reads the RDS password from that file, while an empty path preserves Kubernetes secret-object behavior.

Written by the indexing model from the issue text.