[common][helm] helm support for config providers

[fresh-borzoni]

closes #3686

On the helm side, secrets become declarative:

 secrets:
   mounts:
     - name: paimon-creds
       secretName: fluss-paimon-creds

 configurationOverrides:
   datalake.paimon.s3.secret-key: ${directory:/etc/fluss/secrets/paimon-creds:secret-key}

The chart generates the config.providers config with allowed.paths/env allowlist derived from the declared entries, so the rendered server.yaml stays a plain ConfigMap with no secret material.

Plus some follow-ups from the #3658 review threads:

• allowed.paths canonicalization now fails closed
• duplicate provider identifiers on the classpath fail fast
• test + docs pinning the gated $${ escape semantics

[fresh-borzoni]

@morazow @affo A bit more helm conveniences :) PTAL 🙏

[affo]

@fresh-borzoni thank you so much for this contrib!

Most of my comments are nits, the contribution looks already very good

[fresh-borzoni]

@affo Thank you for the review, addressed, PTAL 🙏

[affo]

Perfect, thank you Anton!