Support loading Basic Auth credentials from Kubernetes Secrets

Current Limitation

Currently, the Gateway Operator only allows configuring Basic Authentication users via the values.yaml inside a ConfigMap. This requires embedding sensitive credentials (passwords or hashes) directly into the ConfigMap manifests or Helm values.

Storing credentials in ConfigMaps is not a security best practice as they are not encrypted at rest by default and are often checked into version control systems in plain text.

Suggested Improvement

Introduce a mechanism to load Basic Authentication users from a standard Kubernetes
Secret

###Proposed Design:

1. Update the Gateway CRD to include an optional authSecretRef field.
2. The Operator should look for a users.yaml key within the referenced Secret.
3. This Secret-based configuration should take precedence over the existing ConfigMap configuration if both are present.

Example Secret:

apiVersion: v1
kind: Secret
type: Opaque
stringData:
  users.yaml: |
    - username: "admin"
      password: "secure-password"
      roles: ["admin"]

Example Gateway CR:

spec:
  authSecretRef:
    name: my-auth-secret

This ensures sensitive data is handled securely using native Kubernetes primitives.

Version

No response

Start by locating the Gateway CRD and the Gateway Operator configuration path that currently reads Basic Auth users from ConfigMap values. Trace how an authSecretRef and its users.yaml key should be represented, then verify Secret-only and both-sources cases; done means the CRD accepts the reference and Secret users take precedence over ConfigMap users.