Separate Injector Vault namespace configurations for authentication and secrets endpoints

We would like to configure the authentication as much as possible in the injector setting (through Helm values), so that the service specific annotations would only include needed configuration for the secrets. The secret backend mounts will normally be deeper in the namespace structure than the auth mount.

As the configured namespace seems to get passed as HTTP header to all requests, there is no way to lock e.g. the auth URL to another namespace.

I guess there should be two configuration options. Also #752 might help a bit.

Start by reviewing the Helm values and injector configuration described in the issue, then read issue #752 for related context. Define the separate namespace settings needed for authentication and secrets endpoints, including how their HTTP headers should differ. Done means the chart exposes and documents both settings without requiring service-specific authentication configuration.

Written by the indexing model from the issue text.