feat: add --no-expand-env-vars flag to deck file convert

[mheap]

Why

deck file convert always expanded env placeholders (e.g. ${{ env "DECK_VAR_NAME" }}) in its output, with no way to suppress this. Users who want to convert format while keeping env references intact — for example, to commit the converted file and resolve secrets at deploy time — had no option to do so.

What changed

Added a --no-expand-env-vars boolean flag (default false) to deck file convert. When set, env placeholders are left unexpanded, matching the mock-env-vars behaviour already available in deck file render.

The flag is wired through both convert code paths: single-file conversion and the 2.x→3.x batch conversion.

Usage:

deck file convert --from kong-gateway-2.x --to kong-gateway-3.x \
  --input-file kong.yaml --no-expand-env-vars

Default behaviour is unchanged — env vars are still expanded unless the flag is passed.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 6.66667% with 14 lines in your changes missing coverage. Please review.
✅ Project coverage is 32.52%. Comparing base (6719b2a) to head (456bff3).

Files with missing lines	Patch %	Lines
cmd/file_convert.go	0.00%	10 Missing ⚠️
cmd/file_render.go	0.00%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1977      +/-   ##
==========================================
- Coverage   32.58%   32.52%   -0.06%     
==========================================
  Files          77       77              
  Lines        6903     6914      +11     
==========================================
  Hits         2249     2249              
- Misses       4474     4485      +11     
  Partials      180      180              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[mheap]

This implementation isn't correct. Instead, let's wait for Kong/go-database-reconciler#444 then use the new mode in this PR

[Prashansa-K]

This implementation isn't correct. Instead, let's wait for Kong/go-database-reconciler#444 then use the new mode in this PR

🤔 But that PR uses this deck branches' commit ID in go.mod
If the implementation is incorrect, why are we creating this cycle?

[mheap]

Implementation updated to use the GDR methods