Separate GitLab-specific credentials from peeks-hub/secrets into peeks-hub/gitlab

## Problem

`peeks-hub/secrets` currently mixes platform credentials with GitLab-specific ones:

- `gitlab_root_password` — only meaningful when GitLab is deployed
- `git_token` — GitLab PAT, used by Backstage and cicd-pipeline RGD

This blocks running the platform **without GitLab** (non-workshop use case): ESO ExternalSecrets on the hub that read `gitlab_root_password` or `git_token` from `peeks-hub/secrets` will fail with `key does not exist` when GitLab is not deployed.

## Proposed fix

Split into two secrets:

| Secret | Keys | Condition |
|---|---|---|
| `peeks-hub/secrets` | `user_password`, `user_password_hash`, `user_password_key`, `backstage_postgres_password`, `grafana_mysql_password`, `devlake_mysql_password` | Always seeded |
| `peeks-hub/gitlab` | `gitlab_root_password`, `git_token` | Only seeded when `enable_gitlab: true` |

## Impacted files

- `cluster-providers/kind-kro-ack/Taskfile.yaml` — `secrets-manager:seed-secrets`
- `cluster-providers/kind-crossplane/Taskfile.yaml` — `secrets-manager:seed-secrets`
- `gitops/addons/charts/gitlab/templates/external-secret.yaml` — read from `peeks-hub/gitlab`
- `gitops/addons/charts/backstage/templates/install.yaml` — `git_token` from `peeks-hub/gitlab`
- `gitops/addons/charts/kro/resource-groups/manifests/cicd-pipeline/cicd-pipeline.yaml` — `GITLAB_TOKEN` from `peeks-hub/gitlab`
- All charts reading these keys should gate on `enable_gitlab`

## Notes

- Must be applied consistently to both `kind-crossplane` and `kind-kro-ack` providers
- `user_password` stays in `peeks-hub/secrets` — it is a Keycloak/IDC platform credential, not GitLab-specific
- `git_token` in CDK is seeded at stack creation time as `root-` — coordinate with CDK seeding logic

Start with the secrets-manager:seed-secrets tasks in both cluster-providers/kind-kro-ack/Taskfile.yaml and cluster-providers/kind-crossplane/Taskfile.yaml, then trace the listed ExternalSecret and chart consumers. Verify the CDK seeding logic for git_token and gate GitLab-dependent consumers on enable_gitlab. Done means both providers consistently seed the two secrets and non-GitLab deployments no longer reference missing keys.

Written by the indexing model from the issue text.