More flexible credential injection filter from Secrets

*Description*:
Sometimes it's not possible to control the exact structure of the secret containing the credential. For example, I can't inject a Kubernetes service account token from a Secret because it's under `token`, not `credential`, and it's not prefixed by `Bearer `.
It should be possible to specify "use bytes at this path in this secret as a bearer token".

Happy to contribute this if it'd be welcome.

*Relevant Links*:
https://gateway.envoyproxy.io/docs/api/extension_types/#injectedcredential