k8s: use secrets to manage openai keys

Currently, the deployment allows to provide an openai key through params.env, which is rendered into a configmap.
We should use an opaque secret instead and allow kustomize-based overlay.

**Objective:** add secret management for the deployment.

**Requirements:**
+ [ ] Declare opaque secret for openai key
+ [ ] (optional) declare additional secrets if needed for other services.