VaultStaticSecret - Kubernetes secret destination in another namespace

**Is your feature request related to a problem? Please describe.**

In our organisation, one team is responsible for managing the roles that have access to the Vault namespace, which can make integration complicated. In this context, we're planning a setup with a controller with the right to consume the entire namespace (aka a single `VaultAuth` resource).

This means that all the secrets would in theory be accessible by anyone who could create a `VaultStaticSecret` resource. Knowing that users are admins in their namespace, we'd like to locate the definition of `VaultStaticSecret` in the controller's namespace, and for k8s secrets (destination) to be deployed in another namespace by the controller.

This way our platform team is responsible for managing the deployed Kubernetes secrets, and users of the namespaces will only be able to read the kubernetes secrets created.

Start by reviewing how VaultStaticSecret resources define their Kubernetes Secret destination and how namespace permissions are handled. Trace the controller behavior for source and destination namespaces, then clarify the required authorization model and cross-namespace acceptance cases with maintainers; done means the requested destination behavior is implemented without allowing unintended secret access.

Written by the indexing model from the issue text.