feat: add automatic imagePullSecret (dockerconfigjson) generation

[christian-deleon]

✨ Summary

Adds imagePullSecret config to OnePasswordItem, allowing the operator to automatically generate properly formatted kubernetes.io/dockerconfigjson secrets from 1Password item fields.

Motivation: Image pull secrets require a specific .dockerconfigjson format with base64-encoded auth. Currently users must either manually create these secrets or use external tooling. This feature lets the operator handle it natively by mapping 1Password fields to the required registry, username, password, and email values.

Example:

apiVersion: onepassword.com/v1
kind: OnePasswordItem
metadata:
  name: my-registry-creds
spec:
  itemPath: "vaults/my-vault/items/registry-creds"
  imagePullSecret:
    registryField: registry
    usernameField: username
    passwordField: password
    emailField: email

Produces:

{
  "auths": {
    "ghcr.io": {
      "username": "myuser",
      "password": "mytoken",
      "email": "me@example.com",
      "auth": "bXl1c2VyOm15dG9rZW4="
    }
  }
}

What's included:

• ImagePullSecretConfig type added to OnePasswordItemSpec with field mappings (registryField, usernameField, passwordField, emailField)
• BuildDockerConfigJSON builder in pkg/template/imagepullsecret.go
• ImagePullSecret processing integrated into BuildKubernetesSecretData as priority 1 (before template and default)
• Controller auto-sets kubernetes.io/dockerconfigjson secret type when imagePullSecret is configured
• Background polling handler preserves imagePullSecret config when re-rendering secrets
• Deployment restart detection now checks pod.Spec.ImagePullSecrets[] references
• USAGEGUIDE.md updated with imagePullSecret documentation

Depends on: #256 (Go template support) — this PR builds on the template PR's API and builder signature changes.

🔗 Resolves:

N/A — new feature

✅ Checklist

• 🖊️ Commits are signed
• 🧪 Tests added/updated:
  • 🔹 Unit — dockerconfigjson builder tests, deployment imagePullSecrets detection tests
  • 🔸 Integration — controller tests for imagePullSecret rendering via envtest
  • 🌐 E2E (Connect) — not added (requires 1Password vault fixtures)
  • 🔑 E2E (Service Account) — not added (requires 1Password vault fixtures)
• 📚 Docs updated (USAGEGUIDE.md)

🕵️ Review Notes & ⚠️ Risks

• Priority system: ImagePullSecret is priority 1 in BuildKubernetesSecretData. If configured but fields are missing/invalid, it falls back to the default field mapping with a logged error.
• No breaking changes: The imagePullSecret field is optional. Existing resources behave identically.
• Restart detection: Added AreImagePullSecretsUsingSecrets and AppendUpdatedImagePullSecrets so deployments referencing updated imagePullSecrets via pod.Spec.ImagePullSecrets are properly detected for auto-restart.
• Dependency: This PR includes commits from feat: add Go template support for secret data rendering #256 in its base. Once feat: add Go template support for secret data rendering #256 merges, the diff will show only the imagePullSecret-specific changes.
• E2E tests require 1Password vault access — maintainers can validate with /ok-to-test.