CH-295 Support Kubernetes Secret references in workflow tasks

[afonsobspinto]

Closes CH-295.

Implemented solution

Workflow tasks currently stringify secret_envs instead of rendering the Kubernetes Secret references. Add an optional CustomTask.secret_envs argument that appends structured environment entries alongside existing literal variables. Kubernetes resolves the credentials; their values are not embedded in the workflow.

How to test this PR

Activate the repository's ch conda environment, then run:

cd libraries/cloudharness-common
python -m pytest -q tests/test_workflow.py tests/test_on_exit_notify.py

Sanity checks:

• The pull request is explicitly linked to the relevant issue(s)
• The issue is well described: clearly states the problem and the general proposed solution(s)
• In this PR it is explicitly stated how to test the current change
• The issue sets the scope and the type of issue (bug, story, task, etc.)
• The relevant components are indicated in the issue (if any)
• All the automated test checks are passing
• All the linked issues are included in one Sprint
• All the linked issues are in the Review state
• All the linked issues are assigned

Breaking changes (select one):

• The present changes preserve the preexisting API and behavior
• This PR and the issue are tagged as a breaking-change and the migration procedure is described above

Possible deployment updates issues (select one):

• There is no reason why existing deployments should break after this update
• This PR and the issue are tagged as alert:deployment

Test coverage (select one):

• Tests for the relevant cases are included in this PR
• The changes included in this PR are out of the current test coverage scope

Documentation (select one):

• The documentation has been updated to match the current changes
• The changes included in this PR are out of the current documentation scope

Nice to have (if relevant):

• Screenshots of the changes
• Explanatory video/animated GIF