Pass secrets to KRM Functions

[CsatariGergely]

KRM Functions often need secrets. kpt needs to have a way to securely share secrets with KRM functions.

[Jaisheesh-2006]

A minimal approach could be standardized environment variable injection for kpt fn eval, which is already well-supported by CI systems and container runtimes. This would keep secrets out of ResourceList/Kptfile and preserve hermetic, explicit execution. Happy to explore if this makes sense