feat: add Go template support for secret data rendering

[christian-deleon]

✨ Summary

Adds Go template support to OnePasswordItem, allowing users to define custom secret data keys using Go templates rendered against the 1Password item's fields, sections, and metadata.

Motivation: The current 1:1 field-to-key mapping is limiting for use cases that require combining fields, reformatting values, or constructing connection strings (e.g. DSNs, URIs). This feature lets users express those transformations declaratively in the CRD spec.

Example:

apiVersion: onepassword.com/v1
kind: OnePasswordItem
metadata:
  name: db-credentials
spec:
  itemPath: "vaults/my-vault/items/my-db"
  template:
    data:
      DSN: "postgres://{{ .Fields.username }}:{{ .Fields.password }}@{{ .Fields.host }}:{{ .Fields.port }}/{{ .Fields.database }}"
      config.yaml: |
        host: {{ .Fields.host }}
        port: {{ .Fields.port }}

What's included:

• SecretTemplate type added to OnePasswordItemSpec with template.data map
• Go template engine (pkg/template/) with BuildTemplateContext and ProcessTemplate
• Template context exposes .Fields (flat), .Sections (nested by section label), and .FieldsByID
• Section and field metadata enrichment in pkg/onepassword/model/ (ID, SectionID, FieldType)
• Template processing integrated into BuildKubernetesSecretData as priority 2 (after imagePullSecret, before default)
• Background polling handler preserves template config when re-rendering secrets
• USAGEGUIDE.md updated with template documentation and examples

🔗 Resolves:

N/A — new feature

✅ Checklist

• 🖊️ Commits are signed
• 🧪 Tests added/updated:
  • 🔹 Unit — template engine tests (pkg/template/template_test.go), model metadata tests
  • 🔸 Integration — controller tests for template rendering via envtest
  • 🌐 E2E (Connect) — not added (requires 1Password vault fixtures)
  • 🔑 E2E (Service Account) — not added (requires 1Password vault fixtures)
• 📚 Docs updated (USAGEGUIDE.md)

🕵️ Review Notes & ⚠️ Risks

• Priority system in BuildKubernetesSecretData: Template rendering is priority 2. If a template is defined, it completely replaces the default field/URL/file mapping. This is intentional — templates give full control over output.
• No breaking changes: The template field is optional. Existing OnePasswordItem resources without template behave identically to before.
• Background polling: The secret update handler now looks up the OnePasswordItem CR to retrieve template config when re-rendering secrets during polling, instead of passing nil.
• E2E tests require 1Password vault access — maintainers can validate with /ok-to-test.