Support `lookup` functions in the helm template calls

**Describe the problem/challenge you have**
More charts are starting to implement the helm [lookup](https://helm.sh/docs/chart_template_guide/functions_and_pipelines/#using-the-lookup-function) function which will check existing secrets for certain values and populate them -- this provides a convenience and form of error checking in certain charts to make sure values are populated and correct. This creates problems for kapp which expects the `helm template` calls to not interact with existing cluster data.

**Describe the solution you'd like**
Allow the `helm template` call to use the service account that exists for the App CR to potentially get some data off the cluster. This would require adding `--dry-run=server` to the helm template command and providing a kubeconfig that would be accessible to the client.

**Anything else you would like to add:**
I don't like this, but helm chart authors are starting to implement this function in a way that breaks certain functionality if it's not used.

---
Vote on this request

This is an invitation to the community to vote on issues, to help us prioritize our backlog. Use the "smiley face" up to the right of this comment to vote.

👍 "I would like to see this addressed as soon as possible"
👎 "There are other more important things to focus on right now"

We are also happy to receive and review Pull Requests if you want to help working on this issue.

Start by locating the helm template invocation and the App CR service-account or kubeconfig handling. Review how rendering currently avoids cluster access and assess the requested server dry-run behavior. Done means charts using Helm lookup can render with the App CR identity while preserving the expected kapp-controller behavior.

Written by the indexing model from the issue text.