New Secret CRD for Vault Tokens

The `vault-agent-injector` is able to log into a Vault auth method in an (init)-container and share the vault token with the main container through a volume mount. Because vault tokens are now managed by the `vault-secrets-operator`, the tokens are not directly consumable by the POD anymore.

There are use-cases for PODs that only require a vault token (and not a secret), for example PODs that operate on the Vault directly: taking snapshots, stepping down leaders, etc.

No files or tests are named. Start by reviewing the existing vault-secrets-operator CRDs and how vault-agent-injector shares tokens through a volume mount, then compare the operator's current secret flow. Done means a defined and implemented CRD path that lets Pods consume a Vault token without requiring a Vault secret.

Written by the indexing model from the issue text.