Store DM source config in k8s secret

Feature Request

Passwords are currently configured using an encryption with a hard coded secret key. This is not a good idea.

Instead it would be better if we can store the passwords as a k8s secret. Maybe we can store the entire source db config as a k8s secret?

Something like this:

# MySQL1 Configuration.

source-id: "mysql-replica-01"

# Indicates whether GTID is enabled
enable-gtid: true

from:
  k8s-secret: "mysql-replica-01"

Not sure if this is the best design... We should discuss alternatives. :-) In particular it would be good to avoid having dm-master/dm-worker explicitly call out the kubeapi. Maybe this should instead be a feature of the tidb-operator so that we have a DMSource CRD where this can be configured?

Start by reviewing how DM source passwords are currently encrypted and how tidb-operator manages Kubernetes resources. Compare storing the full source configuration in a Kubernetes Secret with introducing a DMSource CRD, including whether dm-master and dm-worker would need direct kube-api access. Done means an agreed design and an implementation plan, but the issue does not identify files or tests.