Add Kubernetes secret support for secure Kafka connections

Operator Enhancements:
- Add SecretReference struct to CRD for referencing K8s secrets
- Support secret refs in SSL config (CA, client cert, key, key password)
- Support secret refs in SASL config (username, password, keytab)
- Automatically mount secrets as volumes in pipeline pods
- Secrets mounted at /etc/streamforge/secrets/ with 0400 permissions

CRD Changes (operator/src/crd.rs):
- Add caSecret, certificateSecret, keySecret, keyPasswordSecret to SslConfig
- Add usernameSecret, passwordSecret, keytabSecret to SaslConfig
- Each secret ref contains name and key fields

Reconciler Changes (operator/src/reconciler.rs):
- New add_secret_volumes() method to collect and mount secrets
- Collect secrets from source and all destinations
- Create volume and volume mount for each unique secret
- Support for multiple secrets across different security configs

Documentation:
- Add SECRETS.md - Comprehensive secret management guide
- Add secure-sasl-pipeline.yaml - SASL authentication example
- Add secure-tls-pipeline.yaml - Mutual TLS example
- Update pipelines/README.md with security examples

Benefits:
✅ Store credentials securely in etcd (encrypted)
✅ Separate config from secrets
✅ RBAC control for secret access
✅ Easy credential rotation without changing pipelines
✅ Audit trail for secret access
✅ Support for external secret managers (AWS Secrets Manager, etc.)

This addresses the production security requirement for handling
sensitive Kafka credentials (passwords, certificates, keytabs).

Author: rahulbsw

examples/pipelines/README.md

@@ -20,6 +20,56 @@ kubectl get streamforgepipeline -n streamforge-system
 kubectl get pods -n streamforge-system -l streamforge.io/pipeline=simple-mirror
 ```
 
+### secure-sasl-pipeline.yaml
+Pipeline with SASL authentication using Kubernetes secrets.
+
+**Features:**
+- SASL/SCRAM authentication
+- Credentials stored in Kubernetes secrets (not inline)
+- TLS encryption with CA certificate
+- Production-ready security
+
+**Usage:**
+```bash
+# Create secrets first
+kubectl create secret generic kafka-sasl-credentials \
+  --from-literal=username=myuser \
+  --from-literal=password=mypassword \
+  -n streamforge-system
+
+kubectl create secret generic kafka-ca-cert \
+  --from-file=ca.crt=/path/to/ca-cert.pem \
+  -n streamforge-system
+
+# Deploy pipeline
+kubectl apply -f secure-sasl-pipeline.yaml
+```
+
+### secure-tls-pipeline.yaml
+Pipeline with mutual TLS (mTLS) authentication.
+
+**Features:**
+- Client certificate authentication
+- All certificates stored in secrets
+- Encrypted communication
+- Highest security level
+
+**Usage:**
+```bash
+# Create TLS secret
+kubectl create secret generic kafka-tls-certs \
+  --from-file=ca.crt=/path/to/ca-cert.pem \
+  --from-file=client.crt=/path/to/client-cert.pem \
+  --from-file=client.key=/path/to/client-key.pem \
+  --from-literal=key.password=myKeyPassword \
+  -n streamforge-system
+
+# Deploy pipeline
+kubectl apply -f secure-tls-pipeline.yaml
+```
+
+**📖 For detailed secret management documentation, see [SECRETS.md](./SECRETS.md)**
+
 ## Pipeline Specification
 
 A StreamforgePipeline has the following main components: