Reload user passwords from a Secret without restarting ClickHouse

[alex-zaitsev]

Summary

• Add valueFrom.hotReload: true for ClickHouse user password, password_sha256_hex, and password_double_sha1_hex fields to support password rotation from Kubernetes Secrets without restarting Pods.
• Publish hot-reload users in chop-generated-hot-reload-users.xml inside the CHI-owned Secret chi-<chi>-users. Other users remain in the existing users ConfigMap. Both files are projected into users.d without subPath, allowing ClickHouse to reload updated credentials.
• Watch referenced source Secrets and reconcile the generated Secret when their values change. Update it only when its contents differ; missing or invalid credentials abort reconciliation and preserve the last valid configuration.
• Preserve existing from_env behavior when hotReload is omitted. Enabling hot reload requires a one-time Pod rollout; subsequent password rotations do not.
• Reject hotReload on unsupported fields, including settings, profiles, quotas, files, and Keeper configuration. Automatic Secret-change detection supports references declared directly in the CHI; template-inherited references require manual reconciliation.

Resolves #2092.

Test plan

• Go unit tests: credential rendering, hash validation, missing Secrets, default-user handling, Secret-change detection, reconciliation, cleanup, and restart behavior.
• E2E test_010011_6: verify password rotation on both replicas, rejection of previous passwords, unchanged passwords for users without hotReload, and no Pod restarts.
• CI checks pass.