IAM-backed ObjectStores generate wildcard Secret RBAC

### Summary

When an `ObjectStore` uses AWS IAM role inheritance (`inheritFromIAMRole: true`) and does not reference any credential Secrets, the generated `-barman-cloud` Role still contains a `secrets` rule with no `resourceNames`.

In Kubernetes RBAC, an omitted or empty `resourceNames` list does not restrict the rule to no objects; it allows the verbs on all resources of that type. As a result, an IAM-backed barman-cloud instance can get/list/watch every Secret in the namespace even though barman-cloud does not need any Secret for the AWS credential chain.

### Why this matters

Deployments using IRSA, pod identity, or IMDS typically set `inheritFromIAMRole: true` so barman-cloud gets credentials from the pod environment. In that mode, barman-cloud returns before reading AWS credential Secret references, so the plugin should not grant Secret access unless a credential Secret is actually needed.

### Expected behavior

If no credential Secret names are collected for the ObjectStores referenced by a cluster, the generated Role should not include a `secrets` rule. For AWS credentials with `inheritFromIAMRole: true`, AWS Secret references should be ignored the same way Azure default/managed identity credentials are ignored today.

### Actual behavior

The Role includes a `secrets` rule with an empty `resourceNames` field, which grants access to all Secrets in the namespace.

### Proposed fix

- Skip AWS credential Secret references when `inheritFromIAMRole` is true.
- Omit the generated `secrets` PolicyRule when the collected Secret name set is empty.
- Keep the existing scoped `secrets` rule when explicit credential Secret refs are present.

从 Role 生成和 AWS 凭据引用收集路径开始，然后将其与现有的 Azure 默认/托管身份处理进行比较。验证 IAM 继承情况和显式凭据 Secret 情况，并添加或更新测试，使完成条件为：对于空集合没有 Secret 规则，而当存在 Secret 名称时有一条限定范围的规则。

由索引模型根据 Issue 内容生成。