fix: prevent silent fallback to default value in secret resolver

[burningalchemist]

fixes #1056

This pull request refactors how Kubernetes and Vault secrets are fetched and resolved, improving caching and correctness when multiple jobs or references use different keys from the same secret. Now, the secret providers return the full secret payload as a JSON object, and key extraction is handled centrally (and per-call) by the resolver, ensuring consistent behavior and efficient caching. Comprehensive tests have been added for both providers and the resolver.

Secret provider refactoring and caching improvements:

• config/secret_k8s.go, config/secret_vault.go: The getDSN methods for both the Kubernetes and Vault secret providers now return the entire secret payload as a JSON object, rather than extracting a single key. This enables caching of the full secret and correct per-call key extraction, preventing bugs when multiple jobs use different keys from the same secret.

• config/secret_resolver.go: The resolver's extractKey function now parses the raw JSON payload and extracts the requested key and applies template substitution if needed, ensuring correct per-call behavior and supporting template usage.

Testing improvements:

• config/secret_k8s_test.go, config/secret_vault_test.go: Added comprehensive tests for both secret providers, verifying that they return the correct JSON payload, handle errors (e.g., missing secrets, non-string values), and support namespace inference and Vault engine versions.
• config/secret_resolver_test.go: Added a test to verify that the resolver only fetches a secret once (shared fetch) even when resolving multiple keys from the same secret, and that the correct values are returned for each key.

Dependency and import updates:

• Added necessary imports for JSON encoding/decoding and string manipulation to support the new payload handling.

These changes ensure secrets are fetched efficiently, keys are resolved correctly for each consumer, and the implementation is robustly tested.