Secrets management

[salexo]

From @markvanheeswijk

the secrets and other things that may or may not come (or be assumed in the environment) are a bit problematic currently.
e.g. secrets:

• can workload assume they have been applied in the namespace?
• under what names?
• are they per-user or per-usergroup? e.g. does a user take his own hf-token or is there one on an org-level?
• if we cannot assume they exist or know the names, we need to create them
  • before the workload (but then we need to know ClusterSecretStore details, and keys of external secrets to pull in
  • during the workload submission (but then we need easy way to apply multiple manifests, so we don't have to put them in single custom template file)