feat: Add External Secrets Operator component

## Summary

Add a new security component that installs External Secrets Operator (ESO) and configures it to sync secrets from AWS Secrets Manager into Kubernetes.

## Context

For the EKS GenAI workshop (Module 5: Production-Ready), hardcoded credentials in Kubernetes Secrets need to be replaced with ESO + AWS Secrets Manager for proper secret management. This eliminates the practice of copying ServiceAccount tokens and storing plaintext credentials.

## Changes

- Create `components/security/external-secrets/` with:
- `index.mjs` — Installs ESO via Helm, creates ClusterSecretStore for AWS Secrets Manager
- `main.tf` — IAM role for ESO Pod Identity, Secrets Manager permissions
- `values.template.yaml` — ESO Helm values
- `cluster-secret-store.template.yaml` — ClusterSecretStore manifest for AWS SM backend
- Register new `security` category in `cli-menu.json`
- Add to `config.json` demo components

## Components

- **External Secrets Operator**: Kubernetes operator for external secret management
- **ClusterSecretStore**: Cluster-wide secret store pointing to AWS Secrets Manager
- **IAM Role**: Pod Identity role with Secrets Manager read access
- **EKS Pod Identity Association**: Binds the IAM role to ESO service account

## Related

- Workshop Module 5: Replace hardcoded credentials with ESO + Secrets Manager

Start by reviewing the existing component structure, then create components/security/external-secrets/index.mjs, main.tf, values.template.yaml, and cluster-secret-store.template.yaml. Check cli-menu.json and config.json for the registration and demo-component patterns. Done means the ESO component installs, configures the AWS Secrets Manager store and IAM access, and is registered in both configuration files.

Written by the indexing model from the issue text.