feat: add service secrets management API

[SergioLangaritaBenitez]

Fixes # https://github.com/grycap/issue-tracker/issues/447

Description

Adds CRUD endpoints to manage service environment secrets at runtime, without
redeploying the service. Service secrets are stored in Kubernetes Secrets and
injected into service pods; this PR exposes them through the OSCAR API.

Changes

New endpoints under /system/secrets

• GET /system/secrets — lists the secrets of the accessible services.
  Secret values are only returned for services owned by the caller.
• GET /system/secrets/{serviceName} — returns the environment secrets of a
  specific service.
• PUT /system/secrets/{serviceName} — merges the given key-value pairs into
  the service secrets. Keys that do not exist yet are created and keys not
  present in the request are preserved. The reserved refresh_token key cannot
  be modified.

When updating, the service ConfigMap (FDL) is kept in sync: the new secret keys
are added to environment.secrets with empty values, following the convention
that secret values only live in the Kubernetes Secret.

Files

• pkg/handlers/secrets.go — list, get, and update handlers plus the
  ConfigMap/FDL synchronization logic.
• pkg/handlers/secrets_test.go — handler tests (10 cases covering
  list/get/update, visibility rules, reserved keys, and empty bodies).
• pkg/types/secret.go — request/response types (SecretUpdateRequest,
  ServiceSecrets).
• pkg/utils/secrets.go — GetSecret and MergeSecretData helpers.
• pkg/utils/secrets_test.go — unit tests for the new helpers.
• main.go — route registration for the three endpoints.
• docs/api.md, docs/fdl.md — documentation for the new endpoints.
• pkg/handlers/buckets/{create,list,update}_bucket.go — fix the
  MinIOBucket swagger annotation (utils.MinIOBucket -> types.MinIOBucket)
  so swag init can generate the OpenAPI spec, which was previously failing.

Testing

• go test ./... passes.
• swag init -g main.go --outputTypes yaml succeeds and includes the
  /system/secrets endpoints in the generated spec.

[SergioLangaritaBenitez]

This PR moves the service secrets API under the per-service routes:

• GET /system/services/{serviceName}/secrets?key=KEY returns the value of a single secret key (404 if the key does not exist or is not provided).
• PUT /system/services/{serviceName}/secrets takes the secrets as a plain JSON object in the request body and responds with 204 No Content on success. Existing keys are preserved and the reserved refresh_token key cannot be modified.
• Removed the GET /system/secrets list endpoint, its handler, and the now unused SecretUpdateRequest/ServiceSecrets types.
• Updated swagger annotations, tests, and the API documentation in docs/api.md and docs/fdl.md.

[SergioLangaritaBenitez]

This PR adds the new secrets endpoints and aligns the existing ones with the per-user/per-service model:

• GET /system/secrets?key=KEY and PUT /system/secrets operate on the current user's secret (named after auth.FormatUID(uid)) in the user namespace.
• GET /system/services/{serviceName}/secrets?key=KEY and PUT /system/services/{serviceName}/secrets operate on the secrets of a specific service, replacing the previous /system/secrets/{serviceName} routes.
• GET returns the value of a single secret key (404 if the key or the secret does not exist); PUT accepts a plain JSON object of key-value pairs and responds 204 No Content.
• The reserved keys refresh_token, accessKey, secretKey, and oidc_uid cannot be modified.
• Exported AccessKey, SecretKey, and OIDCUID constants in the auth package and used them consistently across handlers and tests.
• Updated swagger annotations, tests, and the API documentation in docs/api.md.