fix: improve bearerinjector logging for missing credentials

When GetSecret fails, the error message now mentions the
-credentials-paths flag so users know how to configure the secret source.

Also updates the bearerinjector documentation to link to the egress
reference and note the -credentials-paths requirement.

Fixes #3507

Author: mvanhorn

docs/reference/filters.md

@@ -3463,6 +3463,10 @@ from file providing the token as content.
 It is a special form of `setRequestHeaderFromSecret` with `"Authorization"` header name,
 `"Bearer "` prefix and empty suffix.
 
+The token file must be located in a directory passed via the `-credentials-paths` flag.
+See the [egress reference](https://opensource.zalando.com/skipper/reference/egress/#example-bearer-injection)
+for a complete configuration example.
+
 Example:
 
 ```
@@ -3471,6 +3475,9 @@ egress: * -> bearerinjector("/tmp/secrets/my-token") -> "https://api.example.com
 // equivalent to setRequestHeaderFromSecret("Authorization", "/tmp/secrets/my-token", "Bearer ")
 ```
 
+Note: You must start skipper with `-credentials-paths=/tmp/secrets` for the
+filter to find the token file.
+
 ## Open Tracing
 ### tracingBaggageToTag
 

filters/auth/bearer.go

@@ -53,7 +53,7 @@ func newBearerInjectorFilter(s string, sr secrets.SecretsReader) *bearerInjector
 func (f *bearerInjectorFilter) Request(ctx filters.FilterContext) {
 	b, ok := f.secretsReader.GetSecret(f.secretName)
 	if !ok {
-		log.Errorf("Secret %q not found for bearerinjector filter", f.secretName)
+		log.Errorf("Secret %q not found for bearerinjector filter. Make sure the file exists in a directory passed via -credentials-paths flag.", f.secretName)
 		return
 	}
 	ctx.Request().Header.Set(authHeaderName, authHeaderPrefix+string(b))